0002-00000428

Problem description

A request using the Amazon S3-compatible Signature Version 4 (SigV4) is rejected because the headers listed in X-Amz-SignedHeaders (or SignedHeaders in the Authorization header) do not match the headers actually sent in the request.

Causes

X-Amz-SignedHeaders declares every request header included in the signature calculation. OSS validates that each declared header is present in the actual request. The request fails if either of the following is true:

• A header declared in X-Amz-SignedHeaders or SignedHeaders is absent from the actual request.

• A header name in X-Amz-SignedHeaders or SignedHeaders contains an underscore (_).

Examples

The following request declares host;range in X-Amz-SignedHeaders, but the Range header is absent from the request:

GET /test.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request&X-Amz-Date=20221220T084818Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host;range&X-Amz-Signature=ab2***st HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
x-oss-s3-compat: true

X-Amz-SignedHeaders=host;range declares both host and range. However, the Range header is not present in the request. OSS detects the mismatch and rejects the request.

Solutions

Apply the fix that matches your situation.

Option 1: Remove the extra header from X-Amz-SignedHeaders

If you do not need the Range header, remove it from X-Amz-SignedHeaders:

GET /test.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request&X-Amz-Date=20221220T084818Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&X-Amz-Signature=ab2***st HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com

Option 2: Add the missing header to the request

If you need the Range header, add it to the request so it matches the declaration in X-Amz-SignedHeaders:

GET /test.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request&X-Amz-Date=20221220T084818Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host;range&X-Amz-Signature=ab2***st HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Range: 0-2560

Option 3: Remove underscores from header names

If a header name in X-Amz-SignedHeaders or SignedHeaders contains an underscore (_), rename the header to remove it.

We recommend that you use Amazon S3 SDKs to initiate the request. For more information, see Use Amazon S3 SDKs to access OSS.