Presigned Download URL SignatureDoesNotMatch

[dannyc1]

• I've gone though Developer Guide and API reference
• I've checked AWS Forums and StackOverflow for answers

Version of AWS SDK for PHP?
aws/aws-sdk-php: 3.192.1
aws/aws-crt-php: 1.0.2

Version of PHP
7.4.3

My Issue
I'm attempting to create a pre-signed URL that'll be used to download a file from S3. Here is my PHP code:

<?php
  require 'vendor/autoload.php';

  use Aws\S3\Exception\S3Exception;
  use Aws\S3\S3Client;

  $client = new S3Client([
      'profile' => 'test-profile',
      'version' => 'latest',
      'region' => 'us-west-2'      
  ]);

  $bucket = 'testing-php-sdk';
  $key = 'testing';

  // Generate pre-signed URL
  try {
    $cmd = $client->getCommand('GetObject',[
      'Bucket' => $bucket,
      'Key' => $key
    ]);

    $request = $client->createPresignedRequest($cmd, '+30 seconds');
    
    $url = (string)$request->getUri();

    echo $url;

  } catch (S3Exception $e) {
    print($e->getMessage());
  }
?>

The above code generates a URL that looks like this:

https://testing-php-sdk.s3.us-west-2.amazonaws.com/testing?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUB3BHHKIHGWO6IFV%2F20210908%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20210908T172358Z&X-Amz-SignedHeaders=host&X-Amz-Expires=30&X-Amz-Signature=99efeb806a0d30de913de21bca9c4c807577641bf6ccf50e17cd53453194dd78

However, it always results in a SignatureDoesNotMatch error. Here is the full error output:

<Error>
<Code>SignatureDoesNotMatch</Code>
<Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>
<AWSAccessKeyId>*********************</AWSAccessKeyId>
<StringToSign>AWS4-HMAC-SHA256 20210908T173011Z 20210908/us-west-2/s3/aws4_request 3ccaba6ededaaad0110e711a45ab042ecd8a14ac6ecd60601ddca1e83c917f40</StringToSign>
<SignatureProvided>1738405ddab53aaf5618dcde4d42d0db12a8d5158b7f425b4b5a2cc24f753a63⏎</SignatureProvided>
<StringToSignBytes>41 57 53 34 2d 48 4d 41 43 2d 53 48 41 32 35 36 0a 32 30 32 31 30 39 30 38 54 31 37 33 30 31 31 5a 0a 32 30 32 31 30 39 30 38 2f 75 73 2d 77 65 73 74 2d 32 2f 73 33 2f 61 77 73 34 5f 72 65 71 75 65 73 74 0a 33 63 63 61 62 61 36 65 64 65 64 61 61 61 64 30 31 31 30 65 37 31 31 61 34 35 61 62 30 34 32 65 63 64 38 61 31 34 61 63 36 65 63 64 36 30 36 30 31 64 64 63 61 31 65 38 33 63 39 31 37 66 34 30</StringToSignBytes>
<CanonicalRequest>GET /testing X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIAUB3BHHKIHGWO6IFV%2F20210908%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20210908T173011Z&X-Amz-Expires=30&X-Amz-SignedHeaders=host host:testing-php-sdk.s3.us-west-2.amazonaws.com host UNSIGNED-PAYLOAD</CanonicalRequest>
<CanonicalRequestBytes>47 45 54 0a 2f 74 65 73 74 69 6e 67 0a 58 2d 41 6d 7a 2d 41 6c 67 6f 72 69 74 68 6d 3d 41 57 53 34 2d 48 4d 41 43 2d 53 48 41 32 35 36 26 58 2d 41 6d 7a 2d 43 6f 6e 74 65 6e 74 2d 53 68 61 32 35 36 3d 55 4e 53 49 47 4e 45 44 2d 50 41 59 4c 4f 41 44 26 58 2d 41 6d 7a 2d 43 72 65 64 65 6e 74 69 61 6c 3d 41 4b 49 41 55 42 33 42 48 48 4b 49 48 47 57 4f 36 49 46 56 25 32 46 32 30 32 31 30 39 30 38 25 32 46 75 73 2d 77 65 73 74 2d 32 25 32 46 73 33 25 32 46 61 77 73 34 5f 72 65 71 75 65 73 74 26 58 2d 41 6d 7a 2d 44 61 74 65 3d 32 30 32 31 30 39 30 38 54 31 37 33 30 31 31 5a 26 58 2d 41 6d 7a 2d 45 78 70 69 72 65 73 3d 33 30 26 58 2d 41 6d 7a 2d 53 69 67 6e 65 64 48 65 61 64 65 72 73 3d 68 6f 73 74 0a 68 6f 73 74 3a 74 65 73 74 69 6e 67 2d 70 68 70 2d 73 64 6b 2e 73 33 2e 75 73 2d 77 65 73 74 2d 32 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 0a 0a 68 6f 73 74 0a 55 4e 53 49 47 4e 45 44 2d 50 41 59 4c 4f 41 44</CanonicalRequestBytes>
<RequestId>W91QYCWNTDHCCGBA</RequestId>
<HostId>tM3LRQ5yW2b29XQLBbj4EllJ+a9e2WkAKrNcLBAdBkf5qvj+8P+xUBcYisnpb+Q0VoNyTIz1okY=</HostId>
</Error>

I've done a lot of searching and have found people with similar issues, but none of the suggested fixes worked for me. I did attempt various versions of the SDK to make sure that didn't resolve the issue. That didn't help though.

I did get curious to see if maybe my issue was either specific to PHP or perhaps I had an AWS configuration incorrectly set so I wrote this Go code (aws-sdk-go version: 1.40.33, go version: 1.13.8):

package main

import (
	"log"
	"time"

	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/credentials"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/s3"
)

func main() {
	sess, err := session.NewSession(&aws.Config{
		Region:      aws.String("us-west-2"),
		Credentials: credentials.NewSharedCredentials("", "test-profile"),
	})

	svc := s3.New(sess)

	req, _ := svc.GetObjectRequest(&s3.GetObjectInput{
		Bucket: aws.String("testing-php-sdk"),
		Key:    aws.String("testing"),
	})

	urlStr, err := req.Presign(30 * time.Second)

	if err != nil {
		log.Println("Failed to sign request", err)
	}

	log.Println("The URL is", urlStr)
}

The above generates a URL that looks like this:

https://testing-php-sdk.s3.us-west-2.amazonaws.com/testing?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUB3BHHKIHGWO6IFV%2F20210908%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20210908T174002Z&X-Amz-Expires=30&X-Amz-SignedHeaders=host&X-Amz-Signature=f0f5f793ea538c5ee8c14e2763bb3bcce4fb44a944885accbe6770529a0024ce

That URL does work and will download the file from the S3 bucket.

Does anyone see what I'm missing that would prevent PHP from generating the presigned download URL?

[SamRemis]

Hi @dannyc1,
I tried the same code, just replacing it with one of my buckets/keys and a different profile. For me, it worked even on the same versions of the SDK and PHP.
The first thing that I notice is that there's different headers, one of which may be incorrectly signed (or unsigned). The strange thing is that you and I have the same headers on our requests as well.

I'd like to debug further, but could use a bit more information. First of all, what kind of OS are you running this from? Also, could you set your debug log to true and paste the output?

  $client = new S3Client([
      'profile' => 'test-profile',
      'version' => 'latest',
      'debug' => true,
      'region' => 'us-west-2'      
  ]);
  

[dannyc1]

Thanks for the reply, @SamRemis! I'm running Ubuntu 20.04. I added the debug option and got this:

-> Entering step init, name 'idempotency_auto_fill'
---------------------------------------------------

  command was set to array(3) {
    ["instance"]=>
    string(32) "000000005cb79f9100000000719877a4"
    ["name"]=>
    string(9) "GetObject"
    ["params"]=>
    array(4) {
      ["Bucket"]=>
      string(15) "testing-php-sdk"
      ["Key"]=>
      string(7) "testing"
      ["@http"]=>
      array(1) {
        ["debug"]=>
        resource(141) of type (stream)
      }
      ["@context"]=>
      array(0) {
      }
    }
  }
  
  request was set to array(0) {
  }
  


-> Entering step init, name 's3.ssec'
-------------------------------------

  no changes


-> Entering step init, name 's3.source_file'
--------------------------------------------

  no changes


-> Entering step init, name 's3.save_as'
----------------------------------------

  no changes


-> Entering step init, name 's3.location'
-----------------------------------------

  no changes


-> Entering step init, name 's3.auto_encode'
--------------------------------------------

  no changes


-> Entering step init, name 's3.head_object'
--------------------------------------------

  no changes


-> Entering step validate, name 'validation'
--------------------------------------------

  no changes


-> Entering step validate, name 'input_validation_middleware'
-------------------------------------------------------------

  no changes


-> Entering step build, name 'builder'
--------------------------------------

  request.instance was set to 000000005cb79f0700000000719877a4
  request.method was set to GET
  request.headers was set to array(2) {
    ["X-Amz-Security-Token"]=>
    string(7) "[TOKEN]"
    ["Host"]=>
    array(1) {
      [0]=>
      string(26) "s3.us-west-2.amazonaws.com"
    }
  }
  
  request.scheme was set to https
  request.path was set to /testing-php-sdk/testing


-> Entering step build, name 'ApiCallMonitoringMiddleware'
----------------------------------------------------------

  no changes


-> Entering step build, name ''
-------------------------------

  request.instance changed from 000000005cb79f0700000000719877a4 to 000000005cb79f1e00000000719877a4
  request.headers.X-Amz-User-Agent was set to array(1) {
    [0]=>
    string(19) "aws-sdk-php/3.192.1"
  }
  
  request.headers.User-Agent was set to array(1) {
    [0]=>
    string(61) "aws-sdk-php/3.192.1 OS/Linux/5.11.0-34-generic lang/php/7.4.3"
  }
  


-> Entering step build, name 'endpoint_parameter'
-------------------------------------------------

  no changes


-> Entering step build, name 'EndpointDiscoveryMiddleware'
----------------------------------------------------------

  no changes


-> Entering step build, name 's3.checksum'
------------------------------------------

  no changes


-> Entering step build, name 's3.content_type'
----------------------------------------------

  no changes


-> Entering step build, name 's3.endpoint_middleware'
-----------------------------------------------------

  request.instance changed from 000000005cb79f1e00000000719877a4 to 000000005cb79f0200000000719877a4
  request.headers.Host.0 changed from s3.us-west-2.amazonaws.com to testing-php-sdk.s3.us-west-2.amazonaws.com
  request.path changed from /testing-php-sdk/testing to /testing


-> Entering step build, name 's3.bucket_endpoint_arn'
-----------------------------------------------------

  no changes


-> Entering step sign, name 'StreamRequestPayloadMiddleware'
------------------------------------------------------------

  no changes


-> Entering step sign, name 'invocation-id'
-------------------------------------------

  request.instance changed from 000000005cb79f0200000000719877a4 to 000000005cb79f1600000000719877a4
  request.headers.aws-sdk-invocation-id was set to array(1) {
    [0]=>
    string(32) "b1ca335fbf5efb4de021968096c3c1da"
  }
  


-> Entering step sign, name 'retry'
-----------------------------------

  request.instance changed from 000000005cb79f1600000000719877a4 to 000000005cb79f1800000000719877a4
  request.headers.aws-sdk-retry was set to array(1) {
    [0]=>
    string(3) "0/0"
  }
  


-> Entering step sign, name 's3.put_object_url'
-----------------------------------------------

  no changes


-> Entering step sign, name 's3.permanent_redirect'
---------------------------------------------------

  no changes


-> Entering step attempt, name 'ApiCallAttemptMonitoringMiddleware'
-------------------------------------------------------------------

  no changes


<- Leaving step attempt, name 'ApiCallAttemptMonitoringMiddleware'
------------------------------------------------------------------

  result was set to array(2) {
    ["instance"]=>
    string(32) "000000005cb79f1b00000000719877a4"
    ["data"]=>
    array(0) {
    }
  }
  
  Inclusive step time: 0.00035309791564941


<- Leaving step sign, name 's3.permanent_redirect'
--------------------------------------------------

  no changes
  Inclusive step time: 0.00043106079101562


<- Leaving step sign, name 's3.put_object_url'
----------------------------------------------

  no changes
  Inclusive step time: 0.00052189826965332


<- Leaving step sign, name 'retry'
----------------------------------

  no changes
  Inclusive step time: 0.00062084197998047


<- Leaving step sign, name 'invocation-id'
------------------------------------------

  result.data.@metadata was set to array(1) {
    ["transferStats"]=>
    array(1) {
      ["http"]=>
      array(1) {
        [0]=>
        array(0) {
        }
      }
    }
  }
  
  Inclusive step time: 0.00075292587280273


<- Leaving step sign, name 'StreamRequestPayloadMiddleware'
-----------------------------------------------------------

  no changes
  Inclusive step time: 0.00086212158203125


<- Leaving step build, name 's3.bucket_endpoint_arn'
----------------------------------------------------

  no changes
  Inclusive step time: 0.00096988677978516


<- Leaving step build, name 's3.endpoint_middleware'
----------------------------------------------------

  no changes
  Inclusive step time: 0.0012190341949463


<- Leaving step build, name 's3.content_type'
---------------------------------------------

  no changes
  Inclusive step time: 0.0013830661773682


<- Leaving step build, name 's3.checksum'
-----------------------------------------

  no changes
  Inclusive step time: 0.001446008682251


<- Leaving step build, name 'EndpointDiscoveryMiddleware'
---------------------------------------------------------

  no changes
  Inclusive step time: 0.0015130043029785


<- Leaving step build, name 'endpoint_parameter'
------------------------------------------------

  no changes
  Inclusive step time: 0.0015790462493896


<- Leaving step build, name ''
------------------------------

  no changes
  Inclusive step time: 0.0016729831695557


<- Leaving step build, name 'ApiCallMonitoringMiddleware'
---------------------------------------------------------

  no changes
  Inclusive step time: 0.0017678737640381


<- Leaving step build, name 'builder'
-------------------------------------

  no changes
  Inclusive step time: 0.0028839111328125


<- Leaving step validate, name 'input_validation_middleware'
------------------------------------------------------------

  no changes
  Inclusive step time: 0.0039041042327881


<- Leaving step validate, name 'validation'
-------------------------------------------

  no changes
  Inclusive step time: 0.003986120223999


<- Leaving step init, name 's3.head_object'
-------------------------------------------

  no changes
  Inclusive step time: 0.0040731430053711


<- Leaving step init, name 's3.auto_encode'
-------------------------------------------

  no changes
  Inclusive step time: 0.0041317939758301


<- Leaving step init, name 's3.location'
----------------------------------------

  no changes
  Inclusive step time: 0.0041918754577637


<- Leaving step init, name 's3.save_as'
---------------------------------------

  no changes
  Inclusive step time: 0.0042598247528076


<- Leaving step init, name 's3.source_file'
-------------------------------------------

  no changes
  Inclusive step time: 0.0043249130249023


<- Leaving step init, name 's3.ssec'
------------------------------------

  no changes
  Inclusive step time: 0.0044479370117188


<- Leaving step init, name 'idempotency_auto_fill'
--------------------------------------------------

  no changes
  Inclusive step time: 0.0047650337219238

https://testing-php-sdk.s3.us-west-2.amazonaws.com/testing?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAUB3BHHKIHGWO6IFV%2F20210909%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20210909T154042Z&X-Amz-SignedHeaders=host&X-Amz-Expires=30&X-Amz-Signature=7887b902c1e8d4c73f00793722fcf1f31a123331bc8e375e89c2f36ed669855c

[dannyc1]

Just shooting out an update that I'm still trying to work through this issue. If anyone has any ideas let me know.

[SamRemis]

@dannyc1 I think I'll have to contact the S3 team and see what signature they're expecting and how ours differs. We've had issues before where they expect our headers in a different order, so I'm wondering if this is similar.

In the meantime, you're using the same credentials in both PHP and JS, right? And they definitely have access to the objects you're trying to access?

[dannyc1]

I'm not using any JavaScript, but I do have PHP pulling the credentials from my AWS configuration in .aws/credentials. Permissions should be ok since the pre-signed URL generated using the go SDK (which used the same credentials) was able to work as expected.

Thanks for the response. Hopefully, the S3 team will have some insight.

[Huandv]

I got same problem.
Did you resolved it ?

[yenfryherrerafeliz]

Hi @Huandv, thanks for reaching out. Could you please provide a reproducible code snippet so we can understand how your implementation looks like.

Note: Please redact any sensitive information!

Thanks!

[Huandv]

I have fixed my problem
I get presigned url to view file but using 'PutObject' command. That why i got error 'SignatureDoesNotMatch'
Sorry to bother you @yenfryherrerafeliz

[yenfryherrerafeliz]

Hi @dannyc1, could you please let me know if by using the latest version you are still experiencing this issue?. I just looked at your code here and it seems to be correct, I also just tried a presigned url to download an object from a s3 bucket and it worked fine for me.

Please let me know.

Thanks!

[odahcam]

I do experience the same issue currently in the latest SDK version (3.277.5) and latest MinIO version, public buckets work with no problem, but once I try presigning a request the URL always result in the signature does not match error when accessed. I'm using the MinIO Docker image and the PHP 8.0 Docker image, both official images.

[SamRemis]

Signature mismatches can come from a number of places; one common one is when there's an issue with the images clock which impacts time used in signature calculation, other times it can come from having an invalid access key. S3 has an article on troubleshooting this error.

Does a normal getObject call that isn't presigned succeed?

[odahcam]

Yes and you are correct, I ended up solving the issue and left a comment here: minio/minio-js#514 (comment)

[odahcam]

I've also explained it further to my team (I've used chat GPT to translate it to english bc time is money haha):

The idea is for the SDK to think it's working with a host (localhost:9000), and so it will perform encryption and other functions based on that host. But actually, through the proxy configured for development, it will be connecting to host.internal.docker:9000 (which should route connections through Docker's network to the service running the local S3). This makes the encryption compatible with the user's local network, allowing both manual and automated tests to access S3 'presigned URLs'.

In short the solution was basically lie to the SDK so it thinks it is connecting to the route the end user will connect and proxy it through the internal route in the container network. The SDK ends up connecting directly to the MinIO container, but takes in consideration the end user's route for encryption.