Problem description
OSS returns a SignatureDoesNotMatch error because the signature in the request does not match the signature OSS calculated.
Causes
The IP addresses allowed to access OSS resources are specified when you generate the signature. When you send a request using the signed URL, your IP address is not in the whitelist, so the signature check fails.
An error occurs during signature calculation. The parameters used to sign the request differ from the parameters in the actual request, causing a signature mismatch.
Examples
You generate a signed URL that restricts access to a specific IP address range. A machine outside that range sends the request, and OSS rejects it with
SignatureDoesNotMatch.You manually construct the signature string, but the HTTP method, headers, or query string in the request do not exactly match what was signed.
Solutions
Check the following in order:
Verify the request IP address. Confirm that the machine sending the request has an IP address within the range specified when you generated the signed URL. If the IP address has changed—for example, due to a NAT gateway, proxy, or network change—regenerate the signed URL with the correct IP address range.
Check the signature parameters. Make sure the parameters used to generate the signature exactly match the parameters in the actual request. The following must be identical:
Parameter Description HTTP method The method in the signature (for example, GET) must match the method in the requestHeaders Signed headers (for example, Content-Type,x-oss-*) must be included in the request with the same valuesQuery string Query parameters and their values must be identical Use Alibaba Cloud software development kits (SDKs). SDKs calculate signatures automatically, which eliminates manual errors. See Overview to get started.