Question

Presigned URL SignatureDoesNotMatch on Digital Oceans Spaces

Hi all. I’m new to spaces and I can’t seem to get a valid Pre-signed URL with this code. If anyone has pointers or corrections I would really appreciate it. I have also added a wildcard CORS with all permissions.

module.exports = async function (context, req) {
    const aws = require('aws-sdk');

    var signedURL;

    let DO_ENDPOINT = req.body.do_endpoint;
    let DO_ACCESS_KEY_ID = req.body.access_key;
    let DO_SECRET_ACCESS_KEY = req.body.secret_key;
    let DO_SPACE = req.body.bucket;
    let DO_GUID = req.body.key;

    const spacesEndpoint = new aws.Endpoint(DO_ENDPOINT);
    const s3 = new aws.S3({
        endpoint: spacesEndpoint,
        accessKeyId: DO_ACCESS_KEY_ID,
        secretAccessKey: DO_SECRET_ACCESS_KEY,
    });

    const s3Params = {
        Bucket: DO_SPACE,
        Key: DO_GUID,
        ACL: 'public-read',
        Expires: 600,
    };

    s3.getSignedUrl('putObject', s3Params, function (err, url) {
        if (err) {
            context.res = {
                status: 400,
                body: "Something went wrong, please try again."
            };
        } else {
            context.res = {
                body: url
            };
        }
    });
};

The error I keep getting is:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>SignatureDoesNotMatch</Code>
    <RequestId>tx0000000000000a3a794c8-005d4ad207-11f28ea-ams3a</RequestId>
    <HostId>11f28ea-ams3a-ams3</HostId>
</Error>
Submit an answer
Answer a question...

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Ståle Lund • August 8, 2019
Accepted Answer

Hi @robbat2, the pre-signed URL is going to be used for directly uploading file content of images.

Was trying to make a URL that did not need the content-type, but found out yesterday that the content-type was all that was missing in the PUT request.

So this azure function code works:

module.exports = async function (context, req) {
    const aws = require('aws-sdk');

    var signedURL;

    let DO_ENDPOINT = req.body.do_endpoint;
    let DO_ACCESS_KEY_ID = req.body.access_key;
    let DO_SECRET_ACCESS_KEY = req.body.secret_key;
    let DO_SPACE = req.body.bucket;
    let DO_GUID = req.body.key;

    const spacesEndpoint = new aws.Endpoint(DO_ENDPOINT);
    const s3 = new aws.S3({
        endpoint: spacesEndpoint,
        accessKeyId: DO_ACCESS_KEY_ID,
        secretAccessKey: DO_SECRET_ACCESS_KEY,
    });

    const s3Params = {
        Bucket: DO_SPACE,
        Key: DO_GUID,
        ContentType: 'image/jpeg',
        ACL: 'public-read',
        Expires: 600,
    };

    s3.getSignedUrl('putObject', s3Params, function (err, url) {
        if (err) {
            context.res = {
                status: 400,
                body: "Something went wrong, please try again."
            };
        } else {
            context.res = {
                body: url
            };
        }
    });
};

Only thing that needs to be added is the headers in the PUT request:

x-amz-acl:public-read
Content-Type:image/jpeg

Current code is for .jpeg file and needs to be passed the MIME type if its going to be used for something else.

Robin Johnson
DigitalOcean Employee
DigitalOcean Employee badge
• August 7, 2019

Hi, Spaces engineering team member here.

Need a lot more detail about how you’re using the returned URL for your presigned request.

At the very least, you need to confirm that you’re using the HTTP PUT verb in the request with the presigned URL (not POST, not GET)

The team can help you debug it best if you can post (or send a support ticket) with the full HTTP transaction, showing the full HTTP headers on both the request & response side (you should redact your values of DO_ACCESS_KEY_ID and DO_SPACE if you do post it publically)