The signature that OSS calculated does not match the signature in the request.
Problem description
The signature that OSS calculated does not match the signature in the request.
Causes
The request uses an Amazon Simple Storage Service (S3) V4 signature, but the signature OSS calculated does not match the one in the request.
Examples
The following is an example of a request that uses the S3 V4 signature and triggers this error. Key signature parameters are annotated below.
GET /test.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=LTAI****************/20221220/us-east-1/s3/aws4_request&X-Amz-Date=20221220T084818Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host;range&X-Amz-Signature=ab2***st HTTP/1.0
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Range: 0-2560
x-oss-s3-compat: true| Parameter | Description |
|---|---|
X-Amz-Algorithm | The signing algorithm. Must be AWS4-HMAC-SHA256. |
X-Amz-Credential | Contains your AccessKey ID, the signing date, the region, and the service scope (s3/aws4_request). All parts must exactly match what OSS uses to recalculate the signature. |
X-Amz-Date | The date and time when the signature was created, in ISO 8601 format. |
X-Amz-Expires | How long the signed URL remains valid, in seconds. |
X-Amz-SignedHeaders | The HTTP headers included in the signature calculation. Must match the headers sent in the actual request. |
X-Amz-Signature | The HMAC-SHA256 signature. OSS recalculates this value from the request and compares it to this parameter. A mismatch triggers the error. |
Solutions
Choose one of the following approaches based on how you access OSS:
Alibaba Cloud SDKs (recommended): Use when your environment supports them. SDKs handle signature calculation automatically.
Amazon S3 SDKs: Use when you are already integrated with the S3-compatible API.
Use Alibaba Cloud SDKs
Alibaba Cloud SDKs generate signatures automatically without manual calculation. See Use Alibaba Cloud SDKs to initiate requests.
If the error persists after switching to an Alibaba Cloud SDK, check the following:
Verify the endpoint format.
The endpoint must follow this format:
http://oss-<region-id>.aliyuncs.com. For example, the China (Hangzhou) endpoint ishttp://oss-cn-hangzhou.aliyuncs.com. For all region endpoints, see Regions and endpoints.Verify the AccessKey ID and AccessKey secret.
Make sure neither the AccessKey ID nor the AccessKey secret starts or ends with a space. Leading or trailing spaces are invisible but cause signature mismatches.
Verify bucket and object names.
Bucket naming conventions:
Must be unique in OSS
Can contain lowercase letters, digits, and hyphens (-)
Must start and end with a lowercase letter or a digit
Must be 3–63 characters in length
Object naming conventions:
Must be encoded in UTF-8
Must be 1–1,023 bytes in length
Cannot start with a forward slash (/) or a backslash (\\)
Is case-sensitive
Verify the signature method.
If your environment supports OSS SDKs, use the signature method built into the SDK. See Use Alibaba Cloud SDKs to initiate requests.
If your environment does not support OSS SDKs and you are signing requests manually, write code to calculate and attach signatures to REST API requests. See Initiating RESTful API requests.
Check for proxy server headers.
If requests pass through a proxy server, verify that the proxy is not adding extra headers.
Use Amazon S3 SDKs
Access OSS using Amazon S3 SDKs through the S3-compatible API. See Use Amazon S3 SDKs to access OSS.