When you access objects in Object Storage Service (OSS) by using a client, especially a client on which traffic throttling is difficult to implement, a large amount of bandwidth of OSS may be occupied, which obstructs other applications from accessing OSS. To prevent this issue, you can use the single-connection bandwidth throttling feature that is provided by OSS to throttle the bandwidth for object downloads. This way, sufficient bandwidth can be reserved for other applications to access OSS.

Usage notes

  • When you use packaging tools such as Webpack and Browserify, install OSS SDK for Browser.js by running the npm install ali-oss command.
  • OSS SDK for Browser.js is usually used in browsers. To prevent your AccessKey pair from being exposed, we recommend that you use a temporary access credential generated by Security Token Service (STS) to access OSS.

    For more information about how to set up STS, see Use a temporary access credential provided by STS to access OSS in OSS Developer Guide. You can call the AssumeRole operation or use STS SDKs for various programming languages to obtain a temporary access credential. For more information, see STS SDK overview. A temporary access credential contains a security token and a temporary AccessKey pair that consists of an AccessKey ID and an AccessKey secret.

Sample code

The following code provides an example on how to configure bandwidth throttling when you download an object by using a signed URL:

<!DOCTYPE html>
<html lang="en">

  <meta charset="UTF-8" />

  <button id="dowload">Download</button>
  <! -- Import the SDK file -->
  <script type="text/javascript" src="https://gosspublic.alicdn.com/aliyun-oss-sdk-6.16.0.min.js"></script>
  <script type="text/javascript">
      const client = new OSS({
         // Set yourRegion to the endpoint of the region in which the bucket is located. For example, if your bucket is located in the China (Hangzhou) region, set yourRegion to oss-cn-hangzhou. 
         region: 'yourRegion',
         // Specify the temporary AccessKey pair that is obtained from Security Token Service (STS). The AccessKey pair consists of an AccessKey ID and an AccessKey secret. 
         accessKeyId: 'yourAccessKeyId',
         accessKeySecret: 'yourAccessKeySecret',
         // Specify the security token that is obtained from STS. 
        stsToken: 'yourSecurityToken',
        // Specify the name of the bucket. Example: examplebucket. 
        bucket: "examplebucket",

    const download = document.getElementById("dowload");

    download.addEventListener("click", () => {
      console.log(client.signatureUrl('bigData', {
       // Set the download speed limit to 100 KB/s. 
        trafficLimit: 1024 * 8 * 100, 
        responsel: {
          'content-type': 'attachment'



For more information about the complete sample code of single-connection bandwidth throttling, visit GitHub.