0002-00000420

Problem description

The host field is missing from the X-Amz-SignedHeaders parameter. The host field is required.

Causes

The request uses an Amazon S3-compatible Signature Version 4, but X-Amz-SignedHeaders does not include host. X-Amz-SignedHeaders lists the HTTP headers included in the signature calculation. The host header is always required.

Examples

The following request uses query string authentication (presigned URL style). X-Amz-SignedHeaders is set to range only, so host is missing:

GET /test.txt
  ?X-Amz-Algorithm=AWS4-HMAC-SHA256
  &X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request
  &X-Amz-Date=20221220T084818Z
  &X-Amz-Expires=86400
  &X-Amz-SignedHeaders=range
  &X-Amz-Signature=ab2***st HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Range: bytes=100-900
x-oss-s3-compat: true

Solutions

Add host to X-Amz-SignedHeaders, separated from other headers by a semicolon:

GET /test.txt
  ?X-Amz-Algorithm=AWS4-HMAC-SHA256
  &X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request
  &X-Amz-Date=20221220T084818Z
  &X-Amz-Expires=86400
  &X-Amz-SignedHeaders=host;range
  &X-Amz-Signature=ab2***st HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Range: bytes=100-900
x-oss-s3-compat: true

The key change: X-Amz-SignedHeaders=range → X-Amz-SignedHeaders=host;range.

To avoid signature errors, use Amazon S3 SDKs to construct and sign requests. For more information, see Use Amazon S3 SDKs to access OSS.