Question

GET Presigned URL - SignatureDoesNotMatch

Posted on March 5, 2024
DigitalOcean Spaces
Asked by Samuel White

Hello,

I am using the AWSSDK.S3, version 3.7.305.30, for Dotnet Core. I have ran into an issue when creating a PreSignedURL, but have been able to perform most other operations through the SDK with no issues.

I am creating the PreSignedURL in a Dotnet Web API, and then sending the result string to a Client Application, which is attempting to embed the result in an <object>/<iframe>/etc.

However, I cannot get this to work. I always get a SignatureDoesNotMatch error. I get the same error, if I copy the result string, and paste it into a browser (i.e. visit the link).

My code is as follows:

var accessKey = configuration.GetSection("AppSettings:StorageAK").Value;
var secretKey = configuration.GetSection("AppSettings:StorageSecret").Value;

var config = new AmazonS3Config
{
      ServiceURL = "https://MY-SPACES-NAME.ams3.digitaloceanspaces.com",
};

var s3Client = AmazonS3Client(accessKey, secretKey, config);

var presignRequest = new GetPreSignedUrlRequest()
{
      BucketName = tenant.TenantStorageBucket,
      Key = id.ToString(),
      Expires = DateTime.UtcNow.AddSeconds(900),
      ContentType = "text/plain",
};

return await s3Client.GetPreSignedURLAsync(presignRequest);

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Samuel White • March 6, 2024

Accepted Answer

I found my issue. I’ll leave this here just incase someone else encounters the same problem.

The root cause was the ServiceUrl.

var config = new AmazonS3Config
{
      ServiceURL = "https://ams3.digitaloceanspaces.com",
      ForcePathStyle = true,
};

Is the correct configuration.

The peculiar thing, in my instance, was that other operations worked, despite the mistake.

I have come to believe the SignedUrls must follow the ‘Path-style file URL’, as opposed to ‘Virtual-hosted style file URL’, and that the other operations are agnostic regarding the format. But that’s just a suspicion.

@digitalocean - The need for a ForcedPathStyle is currently missing from the C# example at this link: https://docs.digitalocean.com/products/spaces/how-to/use-aws-sdks/

Hope this helps someone in the future.