Sending file to s3 bucket using presigned url gives 403 error (SignatureDoesNotMatch)

Question

I'm generating a presigned URL on the server side of my application that looks like the following:

const s3 = new AWS.S3({
    region: 'us-west-2',
    signatureVersion: 'v4',
});
const params = {
    Bucket: 'bucketName',
    Key: fileName,
    ContentType: 'text/csv',
    Expires: 120
};
    
return s3.getSignedUrl('putObject', params);

Then I am trying to put the file into my S3 bucket using an ajax call that looks like this:

$.ajax({
    url: url
    type: 'PUT',
    data: file,
    processData: false,
    contentType: 'text/csv',
    success: function () {
        console.log('Uploaded data successfully.');
    },
    error: function (xhr) {
        console.log(xhr);
    }
});

However, when I try to do this, I get a 403 Forbidden error and the XML says SignatureDoesNotMatch and The request signature we calculated does not match the signature you provided. Check your key and signing method.

I have made sure that the ContentType is the same for when I am generating the presigned URL AND when I am putting the file in the S3 Bucket. No matter what I do, nothing works and I still get this 403 error. I have tried to do binary/octet-stream for the ContentType and that didn't work. I tried to do ACL: 'public-read' and that didn't work. CORS is configured in my bucket as well so I know that isn't the issue (I had a different error for this). I did notice that in the Network calls, it says this:

Request URL: https://bucket-name.s3.us-west-2.amazonaws.com/fileName?Content-Type=text%2Fcsv&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAXBWQUNDKKHHYM5GH%2F20210219%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20210219T015308Z&X-Amz-Expires=120&X-Amz-Security-Token=FwoGZXIvYXdzEIv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDOQ1EV3FIT00%2Fuo1BCKyAROysQ9G5PY9RFLeS8GwBLPEo7LCEJWstwki7nZatfddDczn0GKO7GwNEe5Qs%2BsLtMZv2xPTXo3Bwur%2BIhH7jV35HHQm976s1mOf8JZe2g%2BimUGNwLxBKY%2BrhWsN8yryNrd6k1VBRf1R9No9Jh%2FIumuwiVEoFLvVBHtILB9i53FdDo%2BJ8T%2BMCliV22SGBAwPQnYk8xvbo1%2B%2B%2B%2BAu%2FwVFl3tvG2yo7PHLzPpKqcpyJq4pMwko3aK8gQYyLUl0hZCTtit2cvBD5YAo57aMZBdTlpN5Wx3q27PSQZ1d8Bq1lQY%2BIQVkPlxZ%2Fw%3D%3D&X-Amz-Signature=446c16abde4d278c42c72373c85a6d44f959330468076e6bd888a8e2816b2b86&X-Amz-SignedHeaders=host
Request Method: PUT
Status Code: 403 Forbidden
Remote Address: 52.218.246.105:443
Referrer Policy: strict-origin-when-cross-origin

For Response Headers:

Referrer Policy: strict-origin-when-cross-origin
Access-Control-Allow-Methods: GET, PUT, POST, DELETE
Access-Control-Allow-Origin: *
Connection: close
Content-Type: application/xml
Date: Fri, 19 Feb 2021 01:53:09 GMT
Server: AmazonS3
Transfer-Encoding: chunked
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method

And Request Headers has Content-Type: text/csv... Not sure if this matters at all though

Any help will be greatly appreciated. I literally searched all over Google and nothing people said worked for me for some reason..

@Marcin Yup they are the same – fairlyMinty Feb 19 '21 at 04:01 — fairlyMinty, Feb 19 '21 at 04:01

score 0 · Answer 1 · answered Feb 19 '21 at 06:20

Adding answer because I cannot comment

Can you check why content-type isn't coming in your "X-Amz-Signed-Headers" along with "host"?

Since, that is part of "params" and therefore part of signature calculation, you should see

X-Amz-SignedHeaders=content-type%3Bhost

instead of ?Content-Type=text%2Fcsv

score 0 · Answer 2 · answered Feb 19 '21 at 08:00

0

check your API key and secret, as SignatureDoesNotMatch error usually refers to the API key and secret mismatch, do refer to this previous answer:

https://stackoverflow.com/a/38837566/6687588

answered Feb 19 '21 at 08:00

martin_y

1
2

Hmm I actually saw that post before but I decided to try to do what that person did with `AWS.config.update({accessKeyId: 'id-omitted', secretAccessKey: 'key-omitted'})`. I actually got a different error this time saying: `InvalidAccessKeyIdThe AWS Access Key Id you provided does not exist in our records.`.. It seems like the ajax call i'm making to the presigned URL isn't using the same access key id? – fairlyMinty Feb 19 '21 at 17:04

score 0 · Accepted Answer · answered Feb 22 '21 at 18:33

0

Turns out that something was wrong with my bucket, which is why I got this error. What exactly is different about the bucket I'm trying to write to is still unknown.. I tried another S3 bucket and it worked fine

answered Feb 22 '21 at 18:33

fairlyMinty

413
8
22

Sending file to s3 bucket using presigned url gives 403 error (SignatureDoesNotMatch)

3 Answers3