0048-00000200

Problem description

If you access Object Storage Service (OSS) objects whose names contain the .apk or .ipa extension in buckets that are created after 00:00 (UTC+8) on August 15, 2023 by using the default public domain names, HTTP status code 400 is returned.

Causes

To enhance data security, if you access objects whose names contain the .apk or .ipa extension in buckets that are created after 00:00 (UTC+8) on August 15, 2023 by using signed URLs that contain the default public domain names (example: bucketname.oss-cn-region.aliyuncs.com) or acceleration endpoints (example: bucketname.oss-accelerate.aliyuncs.com or bucketname.oss-accelerate-overseas.aliyuncs.com) or anonymously, the requests are denied. HTTP status code 400 and the ApkDownloadForbidden error code are returned.  

Examples

In the following example, a public domain name is used to anonymously access objects whose names contain the .apk extension. HTTP status code 400 is returned.

GET /test.apk HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com

HTTP/1.1 400 Bad Request
Server: AliyunOSS

<?xml version="1.0" encoding="UTF-8"?>
<Error>
  <Code>ApkDownloadForbidden</Code>
  <Message>The APK file is not allowed to be distributed in a public network using the OSS endpoint, please use CNAME instead.</Message>
  <RequestId>xxxxxxxxxxxxx</RequestId>
  <HostId>oss-example.oss-cn-hangzhou.aliyuncs.com</HostId>
</Error>

Solutions

Use custom domain names to access these objects. If you use custom domain names to access these objects, the requests are allowed. For more information about how to use custom domain names to access OSS objects, see Map custom domain names.