0002-00000604

Problem description

A signature mismatch error occurred for a request with IP address restrictions.

Causes

The signature included in the request with IP address restrictions does not match the signature calculated by OSS.

Examples

You sent a signed request that includes IP address restrictions, but the request did not originate from the specified IP address range, or the signature was calculated incorrectly.

GET /oss.jpg?x-oss-ac-forward-allow=true&Expires=1647730289&x-oss-ac-subnet-mask=32&Signature=d38L***&OSSAccessKeyId=u8r***n6m HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Date: Tue, 20 Dec 2022 08:48:18 GMT

Solutions

• Make sure that the request is sent from the specified IP address range.

• Use an SDK to send requests. This removes the need to manually sign requests. For more information, see Overview of sending requests using SDKs.

  If a signature mismatch error occurs after you send a request using an SDK, troubleshoot the issue as follows:

  1. Check whether the endpoint is in the correct format.

     For the China (Hangzhou) region, the correct endpoint is http://oss-cn-hangzhou.aliyuncs.com. For more information about the endpoints of other regions, see Regions and endpoints.

  2. Check whether the AccessKey ID and AccessKey secret are valid.

     The AccessKey ID and AccessKey secret cannot start or end with spaces.

  3. Make sure that the bucket name and ObjectKey meet the naming conventions.

     • The naming conventions for bucket names are as follows:

       • Bucket names must be globally unique in OSS.

       • The name can contain only lowercase letters, digits, and hyphens (-).

       • The name must start and end with a lowercase letter or a digit.

       • The name must be 3 to 63 characters in length.

     • The naming conventions for object keys are as follows:

       • Use UTF-8 encoding.

       • The length must be from 1 to 1023 bytes.

       • The name cannot start with a forward slash (/) or a backslash (\).

       • The name is case-sensitive.

  4. Check the signature method.

     • If you calculate signatures yourself in an environment that supports SDKs, use the signature method provided by the OSS SDK. For more information, see Overview of initiating requests using SDKs.

     • If you calculate signatures yourself in an environment that does not support SDKs, you must write code to calculate signatures and add them to REST API requests. For more information, see Overview.

  5. Check whether additional headers are added to the proxy.

• Manually create the signature.

  When you manually create the signature, you can check the StringToSign string returned in the response from the server. Verify that this string is identical to the string-to-sign that you generated on the client side.