0002-00000409

Problem description

The date in the Credential field of the Authorization header does not match the date in the x-amz-date header.

Causes

When using the Amazon S3-compatible V4 signature, the Authorization header contains a Credential field with the following structure:

<AccessKeyId>/<YYYYMMDD>/<region>/<service>/aws4_request

The <YYYYMMDD> segment must match the date in the x-amz-date header. If they differ, OSS rejects the request.

Examples

The following request fails because the Credential date (20130524) does not match the x-amz-date value (20221220T084818Z):

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization:AWS4-HMAC-SHA256 Credential=LTAI****************/20130524/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=1
x-amz-content-sha256: abc***
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

Solutions

Set the Credential date to match the date in x-amz-date. The corrected request:

GET /test.txt HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Authorization:AWS4-HMAC-SHA256 Credential=LTAI****************/20221220/us-east-1/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=34****
x-amz-content-sha256: abc****
x-amz-date: 20221220T084818Z
x-oss-s3-compat: true

To avoid date mismatches, use Amazon S3 SDKs to construct and sign requests automatically. For details, see Use Amazon S3 SDKs to access OSS.