All Products
Search

This Product

    Object Storage Service:0003-00000501

    Document Center

    Object Storage Service:0003-00000501

    Last Updated:Sep 02, 2026

    Problem description

    The request is denied.

    Causes

    The request header does not contain the Referer field or the Referer field is empty, which does not comply with the hotlink protection configurations of the requested bucket.

    API calls made by using an SDK (which include an Authorization header) are not subject to hotlink protection checks. Hotlink protection checks are triggered only by requests that use a presigned URL or by anonymous access. A presigned URL does not include an Authorization header, so it is subject to the hotlink protection policy of the bucket.

    If the bucket has AllowEmptyReferer set to false and the request does not contain a Referer header, or the Referer header is not in the whitelist, OSS returns the error code 0003-00000501. If the Referer header is not in the whitelist, OSS returns a different error code, 0003-00000503. Make sure that you distinguish between the two error codes when you troubleshoot.

    To verify this behavior, you can send a request with a whitelisted Referer header: 

    curl -H 'Referer: https://your-whitelisted-domain.com' '<presigned URL>' -o file

    Alternatively, you can set AllowEmptyReferer to true so that requests without a Referer header are allowed.

    Examples

    In the following request, the AllowEmptyReferer header in the hotlink protection configurations of the requested bucket is set to false. The value false specifies that requests that contain an empty Referer field are not allowed to access OSS resources. 

    <RefererConfiguration>
  <AllowEmptyReferer>false</AllowEmptyReferer>
  <RefererList>
        <Referer>*.example.com</Referer>
  </RefererList>
</RefererConfiguration>

    In the following request, the Referer header is not included. As a result, the request fails. 

    GET /test.txt HTTP/1.1
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: BucketName.oss-example-endpoint.aliyuncs.com

    Solutions

    To resolve the issue, you can use one of the following methods:

    • Add the Referer header to the request. 

      GET /test.txt HTTP/1.1
Date: Tue, 20 Dec 2022 08:48:18 GMT
Host: BucketName.oss-example-endpoint.aliyuncs.com
Referer: https://help.example.com

      If you are downloading an object by using a presigned URL generated with STS temporary credentials, add the Referer header with curl: 

      curl -H 'Referer: https://yourdomain.com' 'https://bucket.oss-cn-hangzhou.aliyuncs.com/object?Expires=...&OSSAccessKeyId=...&Signature=...'

      The domain in the Referer header must be included in the Referer whitelist of the bucket. To configure the whitelist, go to OSS console > the target bucket > Data Security > Hotlink Protection.

    • Set the AllowEmptyReferer header in the hotlink protection configurations of the requested bucket to true. 

      <RefererConfiguration>
  <AllowEmptyReferer>true</AllowEmptyReferer>
</RefererConfiguration>

    References