Problem description
X-Amz-SignedHeaders is blank in the presigned URL, or the SignedHeaders field of the Authorization header is blank.
Causes
The request uses an Amazon S3-compatible V4 signature, but X-Amz-SignedHeaders (for presigned URL requests) or SignedHeaders in the Authorization header (for standard signed requests) is left blank.
X-Amz-SignedHeaders lists the headers included in the signature calculation, separated by semicolons (;). It must contain at least the host header.
Examples
The following presigned URL request has an empty X-Amz-SignedHeaders:
GET /test.txt
?X-Amz-Algorithm=AWS4-HMAC-SHA256
&X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request
&X-Amz-Date=20221220T084818Z
&X-Amz-Expires=86400
&X-Amz-SignedHeaders=
&X-Amz-Signature=ab2**** HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
x-oss-s3-compat: true| Parameter | Description |
|---|---|
X-Amz-Algorithm | The signing algorithm. |
X-Amz-Credential | Your access key ID and scope information (date, region, service). |
X-Amz-Date | The request timestamp in ISO 8601 format. |
X-Amz-Expires | How long the presigned URL is valid, in seconds. |
X-Amz-SignedHeaders | The headers included in the signature, separated by semicolons. Must include at least host. |
X-Amz-Signature | The computed signature. |
Solutions
Use Amazon S3 SDKs to initiate the request. For setup instructions, see Use Amazon S3 SDKs to access OSS.
If you are building a custom client, set a valid value for X-Amz-SignedHeaders or SignedHeaders. The following corrected request includes host;range:
GET /test.txt
?X-Amz-Algorithm=AWS4-HMAC-SHA256
&X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request
&X-Amz-Date=20221220T084818Z
&X-Amz-Expires=86400
&X-Amz-SignedHeaders=host;range
&X-Amz-Signature=ab2s**** HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Range: bytes=100-900