Problem description
The x-oss-ac-subnet-mask parameter in the signed URL is set to an invalid value.
Causes
This error occurs when a signed request includes IP address access restrictions but the value of x-oss-ac-subnet-mask is invalid.
x-oss-ac-subnet-mask specifies the CIDR prefix length used as the subnet mask — the number of leading 1-bits in the mask. When OSS receives the request, it performs a bitwise AND of the client IP address and the subnet mask, then uses the result for signature verification. If the value of the parameter is maliciously changed, the signature cannot pass the verification.
Examples
The following request sets x-oss-ac-subnet-mask to 65536, which is invalid:
GET /oss.jpg?x-oss-ac-forward-allow=true&Expires=1647730289&x-oss-ac-subnet-mask=65536&Signature=d38L**********************8&OSSAccessKeyId=LTAI****************Solutions
Use Alibaba Cloud SDKs to construct signed URLs. SDKs generate and validate request parameters automatically, eliminating errors from manual URL construction. For setup instructions, see Overview.
If you are constructing signed URLs manually, confirm that the value of x-oss-ac-subnet-mask in the request URL is valid. For supported parameters and their constraints, see Add signatures to URLs.