Hide Bucket domain name in OSS error messages during CDN origin fetch - Object Storage Service

When Alibaba Cloud CDN or another CDN triggers an origin fetch error to OSS, OSS returns an error message that includes sensitive information—the OSS Bucket domain name. If this domain name is exposed, it increases the risk of attacks on your OSS Bucket.

Root cause

By default, when CDN sends an origin request to OSS, the Host header in the request uses the OSS Bucket domain name. When OSS receives an invalid request and returns an error, it includes the Host value from the request header in the error response.

In the CDN console, under Default Origin Host settings, Default Origin Host Type is set to Origin Domain Name, and Default Origin Host Address is the corresponding OSS Bucket domain name (for example, {Bucket name}.oss-cn-beijing.aliyuncs.com).

Example issue

For instance, if you request a file that does not exist, OSS returns a 404 error. The error message includes the Bucket domain name. This applies to all error types, including 4xx and 5xx errors—OSS always includes the Bucket domain name in its error responses.

<Error>
  <Code>NoSuchKey</Code>
  <Message>The specified key does not exist.</Message>
  <RequestId>6567EA8FF80D0134381DA6CC</RequestId>
  <HostId>xxx.oss-cn-beijing.aliyuncs.com</HostId>
  <Key>notexist.jpg</Key>
  <EC>0026-00000001</EC>
  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0026-00000001</RecommendDoc>
</Error>

Solution

Warning

If you change the origin Host before binding your CDN-accelerated domain name to the OSS Bucket, OSS cannot process requests with the unknown Host. This causes origin fetch failures and prevents content retrieval. Before changing the origin Host, ensure you have successfully bound the CDN-accelerated domain name to the OSS Bucket and verified that CDN can correctly fetch content from OSS. For details, see Accelerate OSS access with CDN.

Configure the CDN origin Host to use the accelerated domain name. OSS error messages will then display the accelerated domain name instead of the Bucket domain name, effectively hiding the Bucket domain name.

For step-by-step instructions, see Configure the default origin Host.

With Default Origin Host enabled, set Default Origin Host Type to Accelerated Domain Name. The Default Origin Host Address will show the corresponding CDN-accelerated domain name. The following example shows an OSS error message after this change.

<Error>
    <Code>NoSuchKey</Code>
    <Message>The specified key does not exist.</Message>
    <RequestId>6567FBA71253C53034165E24</RequestId>
    <HostId>cdn.xxx.xxx.com</HostId>
    <Key>notexist.jpg</Key>
    <EC>0026-00000001</EC>
    <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0026-00000001</RecommendDoc>
</Error>

References

This method for configuring the origin Host also applies to other scenarios where you need to hide the Bucket domain name, such as using Nginx as a reverse proxy. For more information, see Access OSS through an ECS reverse proxy.