Document Amazon S3 – Authenticating REST says that you should generate authentication signature using following code:
"Authorization: AWS " + AWSAccessKeyId + ":" + base64(hmac-sha1(VERB + "\n" + CONTENT-MD5 + "\n" + CONTENT-TYPE + "\n" + DATE + "\n" + CanonicalizedAmzHeaders + "\n" + CanonicalizedResource))
In documentation you can find following instructions:
The string to be signed is formed by appending the REST verb, content-md5 value, content-type value, date value, canonicalized x-amz headers, and the resource; all separated by newlines.
I followed instructions, but server always responded in the same stubborn fashion:
Message: The request signature we calculated does not match the signature you provided. Check your key and signing method.
The problem was that my request didn’t contain any AmzHeader and therefore CanonicalizedAmzHeaders was empty string followed by new line. That’s wrong.
If CanonizalizedAmzHeaders is empty string then there MUST NOT be new line!
Correct string for signing in case when AmzHeader is empty:
"Authorization: AWS " + AWSAccessKeyId + ":" + base64(hmac-sha1(VERB + "\n" + CONTENT-MD5 + "\n" + CONTENT-TYPE + "\n" + DATE + "\n" + CanonicalizedResource))