Object Storage Service:Upload files using pre-signed URLs

1. The bucket owner generates a pre-signed URL for a PUT request.

   Note

   The maximum validity period of a pre-signed URL generated using an SDK is 7 days. If you use a Security Token Service (STS) token to generate a pre-signed URL, the maximum validity period is 43,200 seconds (12 hours).

   Java

   For more information about the SDK, see Upload a file using a pre-signed URL in Java.

   import com.aliyun.oss.*;
   import com.aliyun.oss.common.auth.*;
   import com.aliyun.oss.common.comm.SignVersion;
   import com.aliyun.oss.model.GeneratePresignedUrlRequest;
   import java.net.URL;
   import java.util.*;
   import java.util.Date;
   
   public class GetSignUrl {
       public static void main(String[] args) throws Throwable {
           // This example uses the public endpoint of the China (Hangzhou) region. Specify the actual endpoint.
           String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
           // Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured.
           EnvironmentVariableCredentialsProvider credentialsProvider = CredentialsProviderFactory.newEnvironmentVariableCredentialsProvider();
           // Specify the bucket name, for example, examplebucket.
           String bucketName = "examplebucket";
           // Specify the full path of the object, for example, exampleobject.txt. The full path of the object cannot contain the bucket name.
           String objectName = "exampleobject.txt";
           // Specify the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set the region to cn-hangzhou.
           String region = "cn-hangzhou";
   
           // Create an OSSClient instance.
           // When the OSSClient instance is no longer in use, call the shutdown method to release resources.
           ClientBuilderConfiguration clientBuilderConfiguration = new ClientBuilderConfiguration();
           clientBuilderConfiguration.setSignatureVersion(SignVersion.V4);
           OSS ossClient = OSSClientBuilder.create()
                   .endpoint(endpoint)
                   .credentialsProvider(credentialsProvider)
                   .clientConfiguration(clientBuilderConfiguration)
                   .region(region)
                   .build();
   
           URL signedUrl = null;
           try {
               // Specify the expiration time of the generated presigned URL in milliseconds. This example sets the expiration time to 1 hour.
               Date expiration = new Date(new Date().getTime() + 3600 * 1000L);
   
               // Generate a presigned URL.
               GeneratePresignedUrlRequest request = new GeneratePresignedUrlRequest(bucketName, objectName, HttpMethod.PUT);
               // Set the expiration time.
               request.setExpiration(expiration);
               // Generate a presigned URL for an HTTP PUT request.
               signedUrl = ossClient.generatePresignedUrl(request);
               // Print the presigned URL.
               System.out.println("signed url for putObject: " + signedUrl);
   
           } catch (OSSException oe) {
               System.out.println("Caught an OSSException, which means your request made it to OSS, "
                       + "but was rejected with an error response for some reason.");
               System.out.println("Error Message:" + oe.getErrorMessage());
               System.out.println("Error Code:" + oe.getErrorCode());
               System.out.println("Request ID:" + oe.getRequestId());
               System.out.println("Host ID:" + oe.getHostId());
           } catch (ClientException ce) {
               System.out.println("Caught an ClientException, which means the client encountered "
                       + "a serious internal problem while trying to communicate with OSS, "
                       + "such as not being able to access the network.");
               System.out.println("Error Message:" + ce.getMessage());
           }
       }
   }       

   Go

   For more information about the SDK, see Upload a file using a pre-signed URL in Go.

   package main
   
   import (
   	"context"
   	"flag"
   	"log"
   	"time"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   )
   
   // Specify the global variables.
   var (
   	region     string // The region in which the bucket is located.
   	bucketName string // The name of the bucket.
   	objectName string // The name of the object.
   )
   
   // Specify the init function used to initialize command line parameters.
   func init() {
   	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
   	flag.StringVar(&bucketName, "bucket", "", "The name of the bucket.")
   	flag.StringVar(&objectName, "object", "", "The name of the object.")
   }
   
   func main() {
   	// Parse command line parameters.
   	flag.Parse()
   
   	// Check whether the bucket name is empty.
   	if len(bucketName) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, bucket name required")
   	}
   
   	// Check whether the region is empty.
   	if len(region) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, region required")
   	}
   
   	// Check whether the object name is empty.
   	if len(objectName) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, object name required")
   	}
   
   	// Load the default configurations and specify the credential provider and region.
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
   		WithRegion(region)
   
   	// Create an OSS client.
   	client := oss.NewClient(cfg)
   
   	// Generate a presigned URL for the PutObject request.
   	result, err := client.Presign(context.TODO(), &oss.PutObjectRequest{
   		Bucket: oss.Ptr(bucketName),
   		Key:    oss.Ptr(objectName),
   		//ContentType: oss.Ptr("text/txt"),                                 // Make sure that the value of the ContentType parameter contained in the URL is the same as the ContentType value specified in the request.
   		//Metadata:    map[string]string{"key1": "value1", "key2": "value2"}, // Make sure that the value of the Metadata parameter contained in the URL is the same as the Metadata value specified in the request.
   	},
   		oss.PresignExpires(10*time.Minute),
   	)
   	if err != nil {
   		log.Fatalf("failed to put object presign %v", err)
   	}
   
   	log.Printf("request method:%v\n", result.Method)
   	log.Printf("request expiration:%v\n", result.Expiration)
   	log.Printf("request url:%v\n", result.URL)
   	if len(result.SignedHeaders) > 0 {
   		// If you specify request headers when you generate a presigned URL that allows HTTP PUT requests, make sure that the request headers are included in the PUT request initiated by using the presigned URL.
   		log.Printf("signed headers:\n")
   		for k, v := range result.SignedHeaders {
   			log.Printf("%v: %v\n", k, v)
   		}
   	}
   }
   

   Python

   For more information about the SDK, see Upload a file using a pre-signed URL in Python.

   import argparse
   import requests
   import alibabacloud_oss_v2 as oss
   
   from datetime import datetime, timedelta
   
   # Create a command line parameter parser and describe the purpose of the script. The example describes how to generate a presigned URL that allows HTTP PUT requests.
   parser = argparse.ArgumentParser(description="presign put object sample")
   
   # Specify the command line parameters, including the required region, bucket name, endpoint, and object name.
   parser.add_argument('--region', help='The region in which the bucket is located.', required=True)
   parser.add_argument('--bucket', help='The name of the bucket.', required=True)
   parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS')
   parser.add_argument('--key', help='The name of the object.', required=True)
   
   def main():
       # Parse the command line parameters to obtain the values specified by the user.
       args = parser.parse_args()
   
       # Obtain access credentials from environment variables for authentication.
       credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()
   
       # Use the default configurations of the SDK to create a configuration object and specify the credential provider.
       cfg = oss.config.load_default()
       cfg.credentials_provider = credentials_provider
   
       # Specify the region attribute of the configuration object based on the command line parameters specified by the user.
       cfg.region = args.region
   
       # If a custom endpoint is provided, modify the endpoint parameter in the configuration object.
       if args.endpoint is not None:
           cfg.endpoint = args.endpoint
   
       # Use the preceding configurations to initialize the OSSClient instance and allow the instance to interact with OSS.
       client = oss.Client(cfg)
   
       # Send the request to initiate a PUT request and generate a presigned URL for the specified object.
       pre_result = client.presign(oss.PutObjectRequest(
           bucket=args.bucket, # The name of the bucket.
           key=args.key, # The name of the object.
       ),expires=timedelta(seconds=3600)) # Specify the validity period of the request. In this example, the validity period is set to 3,600 seconds.
   
       # Display the method, expiration time, and presigned URL specified in the request to check the validity of the presigned URL.
       print(f'method: {pre_result.method},'
             f' expiration: {pre_result.expiration.strftime("%Y-%m-%dT%H:%M:%S.000Z")},'
             f' url: {pre_result.url}'
             )
   
       # Display the signed headers in the request, which are included in the HTTP header when the request is sent.
       for key, value in pre_result.signed_headers.items():
           print(f'signed headers key: {key}, signed headers value: {value}')
   
   # Call the main function to start the processing logic when the script is directly run.
   if __name__ == "__main__":
       main() # Specify the entry points in the functions of the script. The control program flow starts here.

   Node.js

   This section provides an example of a common scenario. For more information about how to generate a pre-signed URL with image processing parameters or a version ID, see Upload files using pre-signed URLs in Node.js.

   const OSS = require("ali-oss");
   
   // Specify a function used to generate a presigned URL.
   async function generateSignatureUrl(fileName) {
     // Obtain the presigned URL.
     const client = await new OSS({
         accessKeyId: 'yourAccessKeyId',
         accessKeySecret: 'yourAccessKeySecret',
         bucket: 'examplebucket',
         region: 'oss-cn-hangzhou',
         authorizationV4: true
     });
   
     return await client.signatureUrlV4('PUT', 3600, {
         headers: {} // Specify the request headers based on the actual request headers.
     }, fileName);
   }
   // Call the function and pass in the object name.
   generateSignatureUrl('yourFileName').then(url => {
     console.log('Generated Signature URL:', url);
   }).catch(err => {
     console.error('Error generating signature URL:', err);
   });

   PHP

   This section provides an example of a common scenario. For more information about how to generate a pre-signed URL with a version ID, see Upload files using pre-signed URLs in PHP.

   <?php
   if (is_file(__DIR__ . '/../autoload.php')) {
       require_once __DIR__ . '/../autoload.php';
   }
   if (is_file(__DIR__ . '/../vendor/autoload.php')) {
       require_once __DIR__ . '/../vendor/autoload.php';
   }
   
   use OSS\OssClient;
   use OSS\Core\OssException;
   use OSS\Http\RequestCore;
   use OSS\Http\ResponseCore;
   use OSS\Credentials\EnvironmentVariableCredentialsProvider;
   
   // Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured.
   $provider = new EnvironmentVariableCredentialsProvider();
   // Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. 
   $endpoint = "yourEndpoint";
   // Specify the name of the bucket. 
   $bucket= "examplebucket";
   // Specify the full path of the object. Do not include the bucket name in the full path of the object. 
   $object = "exampleobject.txt";
   // Set the validity period of the presigned URL to 600 seconds. Maximum value: 32400. 
   $timeout = 600;
   try {
       $config = array(  
           "provider" => $provider,
           "endpoint" => $endpoint,
           'signatureVersion'=>OssClient::OSS_SIGNATURE_VERSION_V4,
           "region"=> "cn-hangzhou"
       );
       $ossClient = new OssClient($config);
       // Generate the presigned URL. 
       $signedUrl = $ossClient->signUrl($bucket, $object, $timeout, "PUT");
       print_r($signedUrl);
   } catch (OssException $e) {
       printf(__FUNCTION__ . ": FAILED\n");
       printf($e->getMessage() . "\n");
       return;
   }           

   Android

   For more information about the SDK, see Upload a file using a pre-signed URL in Android.

   // Specify the name of the bucket. Example: examplebucket. 
   String bucketName = "examplebucket";
   // Specify the full path of the source object. Do not include the bucket name in the full path. Example: exampleobject.txt. 
   String objectKey = "exampleobject.txt";
   // Specify the contentType header. 
   String contentType = "application/octet-stream";
   String url = null;
   try {
       // Generate a presigned URL to upload the object. 
       GeneratePresignedUrlRequest request = new GeneratePresignedUrlRequest(bucketName, objectKey);
       // Set the validity period of the presigned URL to 30 minutes. 
       request.setExpiration(30*60);
       request.setContentType(contentType);    
       request.setMethod(HttpMethod.PUT);
       url = oss.presignConstrainedObjectURL(request);
       Log.d("url", url);
   } catch (ClientException e) {
       e.printStackTrace();
   }

   C++

   For more information about the SDK, see Upload a file using a pre-signed URL in C++.

   #include <alibabacloud/oss/OssClient.h>
   using namespace AlibabaCloud::OSS;
   
   int main(void)
   {
       /* Initialize information about the account that is used to access OSS. */
               
       /* Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. */
       std::string Endpoint = "yourEndpoint";
       /* Specify the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the region to cn-hangzhou.   * /
       std::string Region = "yourRegion";
       /* Specify the name of the bucket. Example: examplebucket. */
       std::string BucketName = "examplebucket";
       /* Specify the full path of the object. Do not include the bucket name in the full path. Example: exampledir/exampleobject.txt. */   
       std::string PutobjectUrlName = "exampledir/exampleobject.txt";
   
        /* Initialize resources, such as network resources. */
       InitializeSdk();
   
       ClientConfiguration conf;
       conf.signatureVersion = SignatureVersionType::V4;
       /* Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. */
       auto credentialsProvider = std::make_shared<EnvironmentVariableCredentialsProvider>();
       OssClient client(Endpoint, credentialsProvider, conf);
       client.SetRegion(Region);
   
       /* Specify the validity period of the pre-signed URL. The maximum validity period is 32,400. Unit: seconds. */
       std::time_t t = std::time(nullptr) + 1200;
       /* Generate a pre-signed URL. */
       auto genOutcome = client.GeneratePresignedUrl(BucketName, PutobjectUrlName, t, Http::Put);
       if (genOutcome.isSuccess()) {
           std::cout << "GeneratePresignedUrl success, Gen url:" << genOutcome.result().c_str() << std::endl;
       }
       else {
           /* Handle exceptions. */
           std::cout << "GeneratePresignedUrl fail" <<
           ",code:" << genOutcome.error().Code() <<
           ",message:" << genOutcome.error().Message() <<
           ",requestId:" << genOutcome.error().RequestId() << std::endl;
           return -1;
       }
   
       /* Release resources, such as network resources. */
       ShutdownSdk();
       return 0;
   }

   iOS

   For more information about the SDK, see Upload a file using a pre-signed URL in iOS.

   // Specify the name of the bucket. 
   NSString *bucketName = @"examplebucket";
   // Specify the name of the object. 
   NSString *objectKey = @"exampleobject.txt";
   NSURL *file = [NSURL fileURLWithPath:@"<filePath>"];
   NSString *contentType = [OSSUtil detemineMimeTypeForFilePath:file.absoluteString uploadName:objectKey];
   __block NSString *urlString;
   // Generate a presigned URL with a validity period for uploading the object. In this example, the validity period of the URL is 30 minutes. 
   OSSTask *task = [client presignConstrainURLWithBucketName:bucketName
                                               withObjectKey:objectKey
                                                  httpMethod:@"PUT"
                                      withExpirationInterval:30 * 60
                                              withParameters:@{}
                                                 contentType:contentType
                                                  contentMd5:nil];
   [task continueWithBlock:^id _Nullable(OSSTask * _Nonnull task) {
       if (task.error) {
           NSLog(@"presign error: %@", task.error);
       } else {
           urlString = task.result;
           NSLog(@"url: %@", urlString);
       }
       return nil;
   }];

   .NET

   For more information about the SDK, see Upload files using pre-signed URLs in .NET.

   using Aliyun.OSS;
   using Aliyun.OSS.Common;
   // Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. 
   var endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
   // Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. 
   var accessKeyId = Environment.GetEnvironmentVariable("OSS_ACCESS_KEY_ID");
   var accessKeySecret = Environment.GetEnvironmentVariable("OSS_ACCESS_KEY_SECRET");
   // Specify the name of the bucket. Example: examplebucket. 
   var bucketName = "examplebucket";
   // Specify the full path of the object. Do not include the bucket name in the full path. Example: exampledir/exampleobject.txt. 
   var objectName = "exampledir/exampleobject.txt";
   var objectContent = "More than just cloud.";
   // Specify the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the region to cn-hangzhou. 
   const string region = "cn-hangzhou";
   
   // Create a ClientConfiguration instance and modify the default parameter settings based on your requirements. 
   var conf = new ClientConfiguration();
   
   // Specify the V4 signature algorithm. 
   conf.SignatureVersion = SignatureVersion.V4;
   
   // Create an OSSClient instance. 
   var client = new OssClient(endpoint, accessKeyId, accessKeySecret, conf);
   conf.SetRegion(region);
   try
   {
       // Generate a presigned URL. 
       var generatePresignedUriRequest = new GeneratePresignedUriRequest(bucketName, objectName, SignHttpMethod.Put)
       {
           // Set the validity period of the presigned URL. Default value: 3600. Unit: seconds. 
           Expiration = DateTime.Now.AddHours(1),
       };
       var signedUrl = client.GeneratePresignedUri(generatePresignedUriRequest);
   }
   catch (OssException ex)
   {
       Console.WriteLine("Failed with error code: {0}; Error info: {1}. \nRequestID:{2}\tHostID:{3}",
           ex.ErrorCode, ex.Message, ex.RequestId, ex.HostId);
   }
   catch (Exception ex)
   {
       Console.WriteLine("Failed with error info: {0}", ex.Message);
   }

   C

   For more information about the SDK, see Download a file using a pre-signed URL in C.

   #include "oss_api.h"
   #include "aos_http_io.h"
   /* Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. */
   const char *endpoint = "yourEndpoint";
   
   /* Specify the name of the bucket. Example: examplebucket. */
   const char *bucket_name = "examplebucket";
   /* Specify the full path of the object. Do not include the bucket name in the full path. Example: exampledir/exampleobject.txt. */
   const char *object_name = "exampledir/exampleobject.txt";
   /* Specify the full path of the local file. */
   const char *local_filename = "yourLocalFilename";
   void init_options(oss_request_options_t *options)
   {
       options->config = oss_config_create(options->pool);
       /* Use a char* string to initialize aos_string_t. */
       aos_str_set(&options->config->endpoint, endpoint);
       /* Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. */
       aos_str_set(&options->config->access_key_id, getenv("OSS_ACCESS_KEY_ID"));
       aos_str_set(&options->config->access_key_secret, getenv("OSS_ACCESS_KEY_SECRET"));
       /* Specify whether to use CNAME. The value 0 indicates that CNAME is not used. */
       options->config->is_cname = 0;
       /* Configure network parameters, such as the timeout period. */
       options->ctl = aos_http_controller_create(options->pool, 0);
   }
   int main(int argc, char *argv[])
   {
       /* Call the aos_http_io_initialize method in main() to initialize global resources, such as network and memory resources. */
       if (aos_http_io_initialize(NULL, 0) != AOSE_OK) {
           exit(1);
       }
       /* Create a memory pool to manage memory. aos_pool_t is equivalent to apr_pool_t. The code that is used to create a memory pool is included in the APR library. */
       aos_pool_t *pool;
       /* Create a memory pool. The value of the second parameter is NULL. This value specifies that the pool does not inherit other memory pools. */
       aos_pool_create(&pool, NULL);
       /* Create and initialize options. This parameter includes global configuration information, such as endpoint, access_key_id, access_key_secret, is_cname, and curl. */
       oss_request_options_t *oss_client_options;
       /* Allocate memory resources in the memory pool to the options. */
       oss_client_options = oss_request_options_create(pool);
       /* Initialize oss_client_options. */
       init_options(oss_client_options);
       /* Initialize the parameters. */
       aos_string_t bucket;
       aos_string_t object;
       aos_string_t file;    
       aos_http_request_t *req;
       apr_time_t now;
       char *url_str;
       aos_string_t url;
       int64_t expire_time; 
       int one_hour = 3600;
       aos_str_set(&bucket, bucket_name);
       aos_str_set(&object, object_name);
       aos_str_set(&file, local_filename);
       expire_time = now / 1000000 + one_hour;    
       req = aos_http_request_create(pool);
       req->method = HTTP_PUT;
       now = apr_time_now(); 
       /* Specify the validity period. Unit: microseconds * /
       expire_time = now / 1000000 + one_hour;
       /* Generate a presigned URL. */
       url_str = oss_gen_signed_url(oss_client_options, &bucket, &object, expire_time, req);
       aos_str_set(&url, url_str);
       printf("The signed URL used to upload the object: %s\n", url_str);    
       /* Release the memory pool. This operation releases memory resources allocated for the request. */
       aos_pool_destroy(pool);
       /* Release the allocated global resources. */
       aos_http_io_deinitialize();
       return 0;
   }

2. A third party uses the generated pre-signed URL to upload the file with a PUT request.

   Important

   A pre-signed URL can be accessed multiple times before it expires. However, performing multiple upload operations creates a risk of overwriting the file. After the URL expires, you must follow Step 1 to regenerate the pre-signed URL to continue accessing the file.

   curl

   curl -X PUT -T /path/to/local/file "https://exampleobject.oss-cn-hangzhou.aliyuncs.com/exampleobject.txt?x-oss-date=20241112T083238Z&x-oss-expires=3599&x-oss-signature-version=OSS4-HMAC-SHA256&x-oss-credential=LTAI****************%2F20241112%2Fcn-hangzhou%2Foss%2Faliyun_v4_request&x-oss-signature=ed5a******************************************************"

   Java

   import org.apache.http.HttpEntity;
   import org.apache.http.client.methods.CloseableHttpResponse;
   import org.apache.http.client.methods.HttpPut;
   import org.apache.http.entity.FileEntity;
   import org.apache.http.impl.client.CloseableHttpClient;
   import org.apache.http.impl.client.HttpClients;
   import java.io.*;
   import java.net.URL;
   import java.util.*;
   
   public class SignUrlUpload {
       public static void main(String[] args) throws Throwable {
           CloseableHttpClient httpClient = null;
           CloseableHttpResponse response = null;
   
           // Replace <signedUrl> with the authorized URL.
           URL signedUrl = new URL("<signedUrl>");
   
           // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
           String pathName = "C:\\Users\\demo.txt";
   
           try {
               HttpPut put = new HttpPut(signedUrl.toString());
               System.out.println(put);
               HttpEntity entity = new FileEntity(new File(pathName));
               put.setEntity(entity);
               httpClient = HttpClients.createDefault();
               response = httpClient.execute(put);
   
               System.out.println("Status code returned for the upload:"+response.getStatusLine().getStatusCode());
               if(response.getStatusLine().getStatusCode() == 200){
                   System.out.println("Upload successful using network library.");
               }
               System.out.println(response.toString());
           } catch (Exception e){
               e.printStackTrace();
           } finally {
               response.close();
               httpClient.close();
           }
       }
   }       

   Go

   package main
   
   import (
   	"fmt"
   	"io"
   	"net/http"
   	"os"
   )
   
   func uploadFile(signedUrl, filePath string) error {
   	// Open the file.
   	file, err := os.Open(filePath)
   	if err != nil {
   		return fmt.Errorf("Unable to open file: %w", err)
   	}
   	defer file.Close()
   
   	// Create a new HTTP client.
   	client := &http.Client{}
   
   	// Create a PUT request.
   	req, err := http.NewRequest("PUT", signedUrl, file)
   	if err != nil {
   		return fmt.Errorf("Failed to create request: %w", err)
   	}
   
   	// Send the request.
   	resp, err := client.Do(req)
   	if err != nil {
   		return fmt.Errorf("Failed to send request: %w", err)
   	}
   	defer resp.Body.Close()
   
   	// Read the response.
   	body, err := io.ReadAll(resp.Body)
   	if err != nil {
   		return fmt.Errorf("Failed to read response: %w", err)
   	}
   
   	fmt.Printf("Status code returned for the upload: %d\n", resp.StatusCode)
   	if resp.StatusCode == 200 {
   		fmt.Println("Upload successful using network library.")
   	}
   	fmt.Println(string(body))
   
   	return nil
   }
   
   func main() {
   	// Replace <signedUrl> with the authorized URL.
   	signedUrl := "<signedUrl>"
   
   	// Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
   	filePath := "C:\\Users\\demo.txt"
   
   	err := uploadFile(signedUrl, filePath)
   	if err != nil {
   		fmt.Println("An error occurred:", err)
   	}
   }
   

   python

   import requests
   
   def upload_file(signed_url, file_path):
       try:
           # Open the file.
           with open(file_path, 'rb') as file:
               # Send a PUT request to upload the file.
               response = requests.put(signed_url, data=file)
        
           print(f"Status code returned for the upload: {response.status_code}")
           if response.status_code == 200:
               print("Upload successful using network library.")
           print(response.text)
    
       except Exception as e:
           print(f"An error occurred: {e}")
   
   if __name__ == "__main__":
       # Replace <signedUrl> with the authorized URL.
       signed_url = "<signedUrl>"
       
       // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
       file_path = "C:\\Users\\demo.txt"
   
       upload_file(signed_url, file_path)
   

   Node.js

   const fs = require('fs');
   const axios = require('axios');
   
   async function uploadFile(signedUrl, filePath) {
       try {
           // Create a read stream.
           const fileStream = fs.createReadStream(filePath);
           
           // Send a PUT request to upload the file.
           const response = await axios.put(signedUrl, fileStream, {
               headers: {
                   'Content-Type': 'application/octet-stream' // Adjust the Content-Type as needed.
               }
           });
   
           console.log(`Status code returned for the upload: ${response.status}`);
           if (response.status === 200) {
               console.log('Upload successful using network library.');
           }
           console.log(response.data);
       } catch (error) {
           console.error(`An error occurred: ${error.message}`);
       }
   }
   
   // Main function.
   (async () => {
       // Replace <signedUrl> with the authorized URL.
       const signedUrl = '<signedUrl>';
       
       // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
       const filePath = 'C:\\Users\\demo.txt';
   
       await uploadFile(signedUrl, filePath);
   })();

   browser.js

   Important

   If you encounter a 403 signature mismatch error when you use Browser.js to upload a file, it is usually because the browser automatically adds the Content-Type request header, but this header was not specified when the presigned URL was generated. This causes a signature verification failure. To resolve this issue, you must specify the Content-Type request header when you generate the presigned URL.

   <!DOCTYPE html>
   <html lang="en">
   <head>
       <meta charset="UTF-8">
       <meta name="viewport" content="width=device-width, initial-scale=1.0">
       <title>File Upload Example</title>
   </head>
   <body>
       <h1>File Upload Example</h1>
   
       <!-- Select a file -->
       <input type="file" id="fileInput" />
       <button id="uploadButton">Upload File</button>
   
       <script>
           // Replace this with the presigned URL generated in Step 1.
           const signedUrl = "<signedUrl>"; 
   
   
           document.getElementById('uploadButton').addEventListener('click', async () => {
               const fileInput = document.getElementById('fileInput');
               const file = fileInput.files[0];
   
               if (!file) {
                   alert('Please select a file to upload.');
                   return;
               }
   
               try {
                   await upload(file, signedUrl);
                   alert('File uploaded successfully!');
               } catch (error) {
                   console.error('Error during upload:', error);
                   alert('Upload failed: ' + error.message);
               }
           });
   
           /**
            * Upload the file to OSS.
            * @param {File} file - The file to upload.
            * @param {string} presignedUrl - The presigned URL.
            */
           const upload = async (file, presignedUrl) => {
               const response = await fetch(presignedUrl, {
                   method: 'PUT',
                   body: file,  // Upload the entire file directly.
               });
   
               if (!response.ok) {
                   throw new Error(`Upload failed, status: ${response.status}`);
               }
   
               console.log('File uploaded successfully');
           };
       </script>
   </body>
   </html>

   C#

   using System.Net.Http.Headers;
   
   // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
   var filePath = "C:\\Users\\demo.txt";
   // Replace <signedUrl> with the authorized URL.
   var presignedUrl = "<signedUrl>";
   
   // Create an HTTP client and open the local file stream.
   using var httpClient = new HttpClient(); 
   using var fileStream = new FileStream(filePath, FileMode.Open, FileAccess.Read);
   using var content = new StreamContent(fileStream);
               
   // Create a PUT request.
   var request = new HttpRequestMessage(HttpMethod.Put, presignedUrl);
   request.Content = content;
   
   // Send the request.
   var response = await httpClient.SendAsync(request);
   
   // Process the response.
   if (response.IsSuccessStatusCode)
   {
       Console.WriteLine($"Upload successful! Status code: {response.StatusCode}");
       Console.WriteLine("Response headers:");
       foreach (var header in response.Headers)
       {
           Console.WriteLine($"{header.Key}: {string.Join(", ", header.Value)}");
       }
   }
   else
   {
       string responseContent = await response.Content.ReadAsStringAsync();
       Console.WriteLine($"Upload failed! Status code: {response.StatusCode}");
       Console.WriteLine("Response content: " + responseContent);
   }

   C++

   #include <iostream>
   #include <fstream>
   #include <curl/curl.h>
   
   void uploadFile(const std::string& signedUrl, const std::string& filePath) {
       CURL *curl;
       CURLcode res;
   
       curl_global_init(CURL_GLOBAL_DEFAULT);
       curl = curl_easy_init();
   
       if (curl) {
           // Set the URL.
           curl_easy_setopt(curl, CURLOPT_URL, signedUrl.c_str());
   
           // Set the request method to PUT.
           curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
   
           // Open the file.
           FILE *file = fopen(filePath.c_str(), "rb");
           if (!file) {
               std::cerr << "Unable to open file: " << filePath << std::endl;
               return;
           }
   
           // Get the file size.
           fseek(file, 0, SEEK_END);
           long fileSize = ftell(file);
           fseek(file, 0, SEEK_SET);
   
           // Set the file size.
           curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)fileSize);
   
           // Set the input file handle.
           curl_easy_setopt(curl, CURLOPT_READDATA, file);
   
           // Execute the request.
           res = curl_easy_perform(curl);
   
           if (res != CURLE_OK) {
               std::cerr << "curl_easy_perform() failed: " << curl_easy_strerror(res) << std::endl;
           } else {
               long httpCode = 0;
               curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode);
               std::cout << "Status code returned for the upload: " << httpCode << std::endl;
   
               if (httpCode == 200) {
                   std::cout << "Upload successful using network library." << std::endl;
               }
           }
   
           // Close the file.
           fclose(file);
   
           // Clean up.
           curl_easy_cleanup(curl);
       }
   
       curl_global_cleanup();
   }
   
   int main() {
       // Replace <signedUrl> with the authorized URL.
       std::string signedUrl = "<signedUrl>";
   
       // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
       std::string filePath = "C:\\Users\\demo.txt";
   
       uploadFile(signedUrl, filePath);
   
       return 0;
   }
   

   Android

   package com.example.signurlupload;
   
   import android.os.AsyncTask;
   import android.util.Log;
   
   import java.io.DataOutputStream;
   import java.io.FileInputStream;
   import java.io.IOException;
   import java.net.HttpURLConnection;
   import java.net.URL;
   
   public class SignUrlUploadActivity {
   
       private static final String TAG = "SignUrlUploadActivity";
   
       public void uploadFile(String signedUrl, String filePath) {
           new UploadTask().execute(signedUrl, filePath);
       }
   
       private class UploadTask extends AsyncTask<String, Void, String> {
   
           @Override
           protected String doInBackground(String... params) {
               String signedUrl = params[0];
               String filePath = params[1];
   
               HttpURLConnection connection = null;
               DataOutputStream dos = null;
               FileInputStream fis = null;
   
               try {
                   URL url = new URL(signedUrl);
                   connection = (HttpURLConnection) url.openConnection();
                   connection.setRequestMethod("PUT");
                   connection.setDoOutput(true);
                   connection.setRequestProperty("Content-Type", "application/octet-stream");
   
                   fis = new FileInputStream(filePath);
                   dos = new DataOutputStream(connection.getOutputStream());
   
                   byte[] buffer = new byte[1024];
                   int length;
   
                   while ((length = fis.read(buffer)) != -1) {
                       dos.write(buffer, 0, length);
                   }
   
                   dos.flush();
                   dos.close();
                   fis.close();
   
                   int responseCode = connection.getResponseCode();
                   Log.d(TAG, "Status code returned for the upload: " + responseCode);
   
                   if (responseCode == 200) {
                       Log.d(TAG, "Upload successful using network library.");
                   }
   
                   return "Upload complete. Status code: " + responseCode;
   
               } catch (IOException e) {
                   e.printStackTrace();
                   return "Upload failed: " + e.getMessage();
               } finally {
                   if (connection != null) {
                       connection.disconnect();
                   }
               }
           }
   
           @Override
           protected void onPostExecute(String result) {
               Log.d(TAG, result);
           }
       }
   
       public static void main(String[] args) {
           SignUrlUploadActivity activity = new SignUrlUploadActivity();
           // Replace <signedUrl> with the authorized URL.
           String signedUrl = "<signedUrl>";
           // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
           String filePath = "C:\\Users\\demo.txt";
           activity.uploadFile(signedUrl, filePath);
       }
   }
   

Perform a multipart upload using pre-signed URLs

If a client cannot be integrated with an OSS SDK but needs to upload a large file, you can use pre-signed URLs to perform a multipart upload. In this method, the server initiates the upload task and generates a pre-signed URL with permissions for each part. The client or a third-party application then uses these URLs to upload the parts. After all parts are uploaded, the server initiates a request to merge the parts into a complete file.

Set headers to define upload policies

When you generate a pre-signed URL, you can specify header parameters to define an upload policy. For example, you can set the file storage class x-oss-storage-class and the content type Content-Type, as shown in the following code examples.

For more information about the OSS system headers that you can set, see PutObject. You can also set custom headers to manage files. For more information, see Manage file metadata.

1. The bucket owner generates a pre-signed URL with header parameters.

   Java

   import com.aliyun.oss.*;
   import com.aliyun.oss.common.auth.*;
   import com.aliyun.oss.common.comm.SignVersion;
   import com.aliyun.oss.internal.OSSHeaders;
   import com.aliyun.oss.model.GeneratePresignedUrlRequest;
   import com.aliyun.oss.model.StorageClass;
   
   import java.net.URL;
   import java.util.*;
   import java.util.Date;
   
   public class GetSignUrl {
       public static void main(String[] args) throws Throwable {
           // This example uses the public endpoint of the China (Hangzhou) region. Specify the actual endpoint.
           String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
           // Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured.
           EnvironmentVariableCredentialsProvider credentialsProvider = CredentialsProviderFactory.newEnvironmentVariableCredentialsProvider();
           // Specify the bucket name, for example, examplebucket.
           String bucketName = "examplebucket";
           // Specify the full path of the object, for example, exampleobject.txt. The full path of the object cannot contain the bucket name.
           String objectName = "exampleobject.txt";
           // Specify the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set the region to cn-hangzhou.
           String region = "cn-hangzhou";
   
           // Create an OSSClient instance.
           // When the OSSClient instance is no longer in use, call the shutdown method to release resources.
           ClientBuilderConfiguration clientBuilderConfiguration = new ClientBuilderConfiguration();
           clientBuilderConfiguration.setSignatureVersion(SignVersion.V4);
           OSS ossClient = OSSClientBuilder.create()
                   .endpoint(endpoint)
                   .credentialsProvider(credentialsProvider)
                   .clientConfiguration(clientBuilderConfiguration)
                   .region(region)
                   .build();
   
           // Set the request headers.
           Map<String, String> headers = new HashMap<String, String>();
           // Specify the StorageClass.
           headers.put(OSSHeaders.STORAGE_CLASS, StorageClass.Standard.toString());
           // Specify the ContentType.
           headers.put(OSSHeaders.CONTENT_TYPE, "text/plain; charset=utf8");
   
           // Set the custom user metadata.
           Map<String, String> userMetadata = new HashMap<String, String>();
           userMetadata.put("key1","value1");
           userMetadata.put("key2","value2");
   
           URL signedUrl = null;
           try {
               // Specify the expiration time of the generated presigned URL in milliseconds. This example sets the expiration time to 1 hour.
               Date expiration = new Date(new Date().getTime() + 3600 * 1000L);
   
               // Generate a presigned URL.
               GeneratePresignedUrlRequest request = new GeneratePresignedUrlRequest(bucketName, objectName, HttpMethod.PUT);
               // Set the expiration time.
               request.setExpiration(expiration);
   
               // Add the request headers to the request.
               request.setHeaders(headers);
               // Add the custom user metadata.
               request.setUserMetadata(userMetadata);
   
               // Generate a presigned URL for an HTTP PUT request.
               signedUrl = ossClient.generatePresignedUrl(request);
               // Print the presigned URL.
               System.out.println("signed url for putObject: " + signedUrl);
   
           } catch (OSSException oe) {
               System.out.println("Caught an OSSException, which means your request made it to OSS, "
                       + "but was rejected with an error response for some reason.");
               System.out.println("Error Message:" + oe.getErrorMessage());
               System.out.println("Error Code:" + oe.getErrorCode());
               System.out.println("Request ID:" + oe.getRequestId());
               System.out.println("Host ID:" + oe.getHostId());
           } catch (ClientException ce) {
               System.out.println("Caught an ClientException, which means the client encountered "
                       + "a serious internal problem while trying to communicate with OSS, "
                       + "such as not being able to access the network.");
               System.out.println("Error Message:" + ce.getMessage());
           }
       }
   }       

   Go

   package main
   
   import (
   	"context"
   	"flag"
   	"log"
   	"time"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   )
   
   // Define global variables.
   var (
   	region     string // Region in which the bucket is located.
   	bucketName string // Name of the bucket.
   	objectName string // Name of the object.
   )
   
   // Specify the init function used to initialize command line parameters.
   func init() {
   	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
   	flag.StringVar(&bucketName, "bucket", "", "The name of the bucket.")
   	flag.StringVar(&objectName, "object", "", "The name of the object.")
   }
   
   func main() {
   	// Parse command line parameters.
   	flag.Parse()
   
   	// Check whether the name of the bucket is specified.
   	if len(bucketName) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, bucket name required")
   	}
   
   	// Check whether the region is specified.
   	if len(region) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, region required")
   	}
   
   	// Check whether the name of the object is specified.
   	if len(objectName) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, object name required")
   	}
   
   	// Load the default configurations and specify the credential provider and region.
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
   		WithRegion(region)
   
   	// Create an OSS client.
   	client := oss.NewClient(cfg)
   
   	// Generate a presigned URL for the PutObject request.
   	result, err := client.Presign(context.TODO(), &oss.PutObjectRequest{
   		Bucket:      oss.Ptr(bucketName),
   		Key:         oss.Ptr(objectName),
   		ContentType:  oss.Ptr("text/plain;charset=utf8"),                    // Ensure that the value of the ContentType parameter contained in the URL is the same as the ContentType value specified in the request.
   		StorageClass: oss.StorageClassStandard,                              // Ensure that the value of the StorageClass parameter contained in the URL is the same as the StorageClass value specified in the request.
   		Metadata:    map[string]string{"key1": "value1", "key2": "value2"}, // Ensure that the value of Metadata contained in the URL is the same as the Metadata value specified in the request.
   	},
   		oss.PresignExpires(10*time.Minute),
   	)
   	if err != nil {
   		log.Fatalf("failed to put object presign %v", err)
   	}
   
   	log.Printf("request method:%v\n", result.Method)
   	log.Printf("request expiration:%v\n", result.Expiration)
   	log.Printf("request url:%v\n", result.URL)
   	if len(result.SignedHeaders) > 0 {
   		// If you specify request headers when you generate a presigned URL that allows HTTP PUT requests, make sure that the request headers are included in the PUT request initiated by using the URL.
   		log.Printf("signed headers:\n")
   		for k, v := range result.SignedHeaders {
   			log.Printf("%v: %v\n", k, v)
   		}
   	}
   }
   

   Python

   import argparse
   import requests
   import alibabacloud_oss_v2 as oss
   
   from datetime import datetime, timedelta
   
   # Create a command line parameter parser and describe the purpose of the script. The example describes how to generate a presigned URL that allows HTTP PUT requests.
   parser = argparse.ArgumentParser(description="presign put object sample")
   
   # Specify the command line parameters, including the required region, bucket name, endpoint, and object name.
   parser.add_argument('--region', help='The region in which the bucket is located.', required=True)
   parser.add_argument('--bucket', help='The name of the bucket.', required=True)
   parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS')
   parser.add_argument('--key', help='The name of the object.', required=True)
   
   def main():
       # Parse the command line parameters to obtain the values specified by the user.
       args = parser.parse_args()
   
       # Obtain access credentials from environment variables for authentication.
       credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()
   
       # Use the default configurations of the SDK to create a configuration object and specify the credential provider.
       cfg = oss.config.load_default()
       cfg.credentials_provider = credentials_provider
   
       # Specify the region attribute of the configuration object based on the command line parameters specified by the user.
       cfg.region = args.region
   
       # If a custom endpoint is provided, modify the endpoint parameter in the configuration object.
       if args.endpoint is not None:
           cfg.endpoint = args.endpoint
   
       # Use the preceding configurations to initialize the OSSClient instance and allow the instance to interact with OSS.
       client = oss.Client(cfg)
   
       # Send the request to initiate a PUT request and generate a presigned URL for the specified object.
       pre_result = client.presign(oss.PutObjectRequest(
           bucket=args.bucket, # The name of the bucket.
           key=args.key, # The name of the object.
           content_type='text/plain;charset=utf8', # Specify the content type.
           storage_class='Standard', # Specify the storage class.
           metadata={
               'key1': 'value1',   # Specify the metadata.
               'key2': 'value2'    # Specify the metadata.
           }
       ),expires=timedelta(seconds=3600)) # Specify the validity period of the request. In this example, the validity period is set to 3,600 seconds.
   
   
       # Display the method, expiration time, and presigned URL specified in the request to check the validity of the presigned URL.
       print(f'method: {pre_result.method},'
             f' expiration: {pre_result.expiration.strftime("%Y-%m-%dT%H:%M:%S.000Z")},'
             f' url: {pre_result.url}'
             )
   
       # Display the signed headers in the request, which are included in the HTTP header when the request is sent.
       for key, value in pre_result.signed_headers.items():
           print(f'signed headers key: {key}, signed headers value: {value}')
   
   # Call the main function to start the processing logic when the script is directly run.
   if __name__ == "__main__":
       main() # Specify the entry points in the functions of the script. The control program flow starts here.

2. A third party uses the pre-signed URL to upload the file and passes the same headers.

   curl

   curl -X PUT \
        -H "Content-Type: text/plain;charset=utf8" \
        -H "x-oss-storage-class: Standard" \
        -H "x-oss-meta-key1: value1" \
        -H "x-oss-meta-key2: value2" \
        -T "C:\\Users\\demo.txt" \
        "https://exampleobject.oss-cn-hangzhou.aliyuncs.com/exampleobject.txt?x-oss-date=20241112T083238Z&x-oss-expires=3599&x-oss-signature-version=OSS4-HMAC-SHA256&x-oss-credential=LTAI****************%2F20241112%2Fcn-hangzhou%2Foss%2Faliyun_v4_request&x-oss-signature=ed5a******************************************************"

   Java

   import com.aliyun.oss.internal.OSSHeaders;
   import com.aliyun.oss.model.StorageClass;
   import org.apache.http.HttpEntity;
   import org.apache.http.client.methods.CloseableHttpResponse;
   import org.apache.http.client.methods.HttpPut;
   import org.apache.http.entity.FileEntity;
   import org.apache.http.impl.client.CloseableHttpClient;
   import org.apache.http.impl.client.HttpClients;
   import java.io.*;
   import java.net.URL;
   import java.util.*;
   
   public class SignUrlUpload {
       public static void main(String[] args) throws Throwable {
           CloseableHttpClient httpClient = null;
           CloseableHttpResponse response = null;
   
           // Replace <signedUrl> with the authorized URL.
           URL signedUrl = new URL("<signedUrl>");
   
           // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
           String pathName = "C:\\Users\\demo.txt";
   
           // Set the request headers. The request header information must be the same as the information used when the URL was generated.
           Map<String, String> headers = new HashMap<String, String>();
           //Specify the storage class of the object.
           headers.put(OSSHeaders.STORAGE_CLASS, StorageClass.Standard.toString());
           //Specify the ContentType.
           headers.put(OSSHeaders.CONTENT_TYPE, "text/plain;charset=utf8");
   
           // Set the custom user metadata. The custom user metadata must be the same as the information used when the URL was generated.
           Map<String, String> userMetadata = new HashMap<String, String>();
           userMetadata.put("key1","value1");
           userMetadata.put("key2","value2");
   
           try {
               HttpPut put = new HttpPut(signedUrl.toString());
               System.out.println(put);
               HttpEntity entity = new FileEntity(new File(pathName));
               put.setEntity(entity);
               // If you set header parameters, such as user metadata and storage class, when you generate the presigned URL, you must also send these parameters to the server when you use the presigned URL to upload the file. A signature error is reported if the parameters sent to the server are inconsistent with the signed parameters.
               for(Map.Entry header: headers.entrySet()){
                   put.addHeader(header.getKey().toString(),header.getValue().toString());
               }
               for(Map.Entry meta: userMetadata.entrySet()){
                   // If you use userMeta, the SDK internally adds the 'x-oss-meta-' prefix. When you use other methods to generate a presigned URL for an upload, you must also add the 'x-oss-meta-' prefix to the userMeta.
                   put.addHeader("x-oss-meta-"+meta.getKey().toString(), meta.getValue().toString());
               }
   
               httpClient = HttpClients.createDefault();
   
               response = httpClient.execute(put);
   
               System.out.println("Status code returned for the upload:"+response.getStatusLine().getStatusCode());
               if(response.getStatusLine().getStatusCode() == 200){
                   System.out.println("Upload successful using network library.");
               }
               System.out.println(response.toString());
           } catch (Exception e){
               e.printStackTrace();
           } finally {
               response.close();
               httpClient.close();
           }
       }
   }       

   Go

   package main
   
   import (
   	"bytes"
   	"fmt"
   	"io/ioutil"
   	"net/http"
   	"os"
   )
   
   func uploadFile(signedUrl string, filePath string, headers map[string]string, metadata map[string]string) error {
   	// Open the file.
   	file, err := os.Open(filePath)
   	if err != nil {
   		return err
   	}
   	defer file.Close()
   
   	// Read the file content.
   	fileBytes, err := ioutil.ReadAll(file)
   	if err != nil {
   		return err
   	}
   
   	// Create a request.
   	req, err := http.NewRequest("PUT", signedUrl, bytes.NewBuffer(fileBytes))
   	if err != nil {
   		return err
   	}
   
   	// Set the request headers.
   	for key, value := range headers {
   		req.Header.Set(key, value)
   	}
   
   	// Set the custom user metadata.
   	for key, value := range metadata {
   		req.Header.Set(fmt.Sprintf("x-oss-meta-%s", key), value)
   	}
   
   	// Send the request.
   	client := &http.Client{}
   	resp, err := client.Do(req)
   	if err != nil {
   		return err
   	}
   	defer resp.Body.Close()
   
   	// Process the response.
   	fmt.Printf("Status code returned for the upload: %d\n", resp.StatusCode)
   	if resp.StatusCode == 200 {
   		fmt.Println("Upload successful using network library.")
   	} else {
   		fmt.Println("Upload failed.")
   	}
   	body, _ := ioutil.ReadAll(resp.Body)
   	fmt.Println(string(body))
   
   	return nil
   }
   
   func main() {
   	// Replace <signedUrl> with the authorized URL.
   	signedUrl := "<signedUrl>"
   
   	// Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
   	filePath := "C:\\Users\\demo.txt"
   
   	// Set the request headers. The request header information must be the same as the information used when the URL was generated.
   	headers := map[string]string{
   		"Content-Type": "text/plain;charset=utf8",
   		"x-oss-storage-class": "Standard",
   	}
   
   	// Set the custom user metadata. The custom user metadata must be the same as the information used when the URL was generated.
   	metadata := map[string]string{
   		"key1": "value1",
   		"key2": "value2",
   	}
   
   	err := uploadFile(signedUrl, filePath, headers, metadata)
   	if err != nil {
   		fmt.Printf("An error occurred: %v\n", err)
   	}
   }
   

   Python

   import requests
   from requests.auth import HTTPBasicAuth
   import os
   
   def upload_file(signed_url, file_path, headers=None, metadata=None):
       """
       Use a presigned URL to upload a file to OSS.
   
       :param signed_url: The presigned URL.
       :param file_path: The full path of the file to upload.
       :param headers: Optional. Custom HTTP headers.
       :param metadata: Optional. Custom metadata.
       :return: None
       """
       if not headers:
           headers = {}
       if not metadata:
           metadata = {}
   
       # Update headers and add the metadata prefix.
       for key, value in metadata.items():
           headers[f'x-oss-meta-{key}'] = value
   
       try:
           with open(file_path, 'rb') as file:
               response = requests.put(signed_url, data=file, headers=headers)
               print(f"Status code returned for the upload: {response.status_code}")
               if response.status_code == 200:
                   print("Upload successful using network library.")
               else:
                   print("Upload failed.")
               print(response.text)
       except Exception as e:
           print(f"An error occurred: {e}")
   
   if __name__ == "__main__":
       // Replace <signedUrl> with the authorized URL.
       signed_url = "<signedUrl>"
      
       // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the directory where the script is located by default.
       file_path = "C:\\Users\\demo.txt"
   
       // Set the request headers. The request header information must be the same as the information used when the URL was generated.
       headers = {
            "Content-Type": "text/plain;charset=utf8",
            "x-oss-storage-class": "Standard"
       }
   
       // Set the custom user metadata. The custom user metadata must be the same as the information used when the URL was generated.
       metadata = {
            "key1": "value1",
            "key2": "value2"
       }
   
       upload_file(signed_url, file_path, headers, metadata)
   

   Node.js

   const fs = require('fs');
   const axios = require('axios');
   
   async function uploadFile(signedUrl, filePath, headers = {}, metadata = {}) {
       try {
           // Update headers and add the metadata prefix.
           for (const [key, value] of Object.entries(metadata)) {
               headers[`x-oss-meta-${key}`] = value;
           }
   
           // Read the file stream.
           const fileStream = fs.createReadStream(filePath);
   
           // Send a PUT request.
           const response = await axios.put(signedUrl, fileStream, {
               headers: headers
           });
   
           console.log(`Status code returned for the upload: ${response.status}`);
           if (response.status === 200) {
               console.log("Upload successful using network library.");
           } else {
               console.log("Upload failed.");
           }
           console.log(response.data);
       } catch (error) {
           console.error(`An error occurred: ${error.message}`);
       }
   }
   
   // Main function.
   (async () => {
       // Replace <signedUrl> with the authorized URL.
       const signedUrl = "<signedUrl>";
   
       // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the directory where the script is located by default.
       const filePath = "C:\\Users\\demo.txt";
   
       // Set the request headers. The request header information must be the same as the information used when the URL was generated.
       const headers = {
            "Content-Type": "text/plain;charset=utf8",
            "x-oss-storage-class": "Standard"
       };
   
       // Set the custom user metadata. The custom user metadata must be the same as the information used when the URL was generated.
       const metadata = {
            "key1": "value1",
            "key2": "value2"
       };
   
       await uploadFile(signedUrl, filePath, headers, metadata);
   })();
   

   Browser.js

   Important

   If you encounter a 403 signature mismatch error when you use Browser.js to upload a file, it is usually because the browser automatically adds the Content-Type request header, but this header was not specified when the presigned URL was generated. This causes a signature verification failure. To resolve this issue, you must specify the Content-Type request header when you generate the presigned URL.

   <!DOCTYPE html>
   <html lang="en">
   <head>
       <meta charset="UTF-8">
       <meta name="viewport" content="width=device-width, initial-scale=1.0">
       <title>File Upload Example</title>
   </head>
   <body>
       <h1>File Upload Example (Java SDK)</h1>
   
       <input type="file" id="fileInput" />
       <button id="uploadButton">Upload File</button>
   
       <script>
           // Replace this with the actual presigned URL.
           const signedUrl = "<signedUrl>"; 
   
           document.getElementById('uploadButton').addEventListener('click', async () => {
               const fileInput = document.getElementById('fileInput');
               const file = fileInput.files[0];
   
               if (file) {
                   try {
                       await upload(file, signedUrl);
                   } catch (error) {
                       console.error('Error during upload:', error);
                       alert('Upload failed: ' + error.message);
                   }
               } else {
                   alert('Please select a file to upload.');
               }
           });
   
           const upload = async (file, presignedUrl) => {
               const headers = {
                   "Content-Type": "text/plain;charset=utf8",
                   'x-oss-storage-class': 'Standard',
                   'x-oss-meta-key1': 'value1',
                   'x-oss-meta-key2': 'value2'
               };
   
               const response = await fetch(presignedUrl, {
                   method: 'PUT',
                   headers: headers,
                   body: file
               });
   
               if (!response.ok) {
                   throw new Error(`Upload failed, status: ${response.status}`);
               }
   
               alert('File uploaded successfully');
               console.log('File uploaded successfully');
           };
       </script>
   </body>
   </html>

   C#

   using System.Net.Http.Headers;
   
   // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
   var filePath = "C:\\Users\\demo.txt";
   // Replace <signedUrl> with the authorized URL.
   var presignedUrl = "<signedUrl>";
   
   // Create an HTTP client and open the local file stream.
   using var httpClient = new HttpClient(); 
   using var fileStream = new FileStream(filePath, FileMode.Open, FileAccess.Read);
   using var content = new StreamContent(fileStream);
               
   // Create a PUT request.
   var request = new HttpRequestMessage(HttpMethod.Put, presignedUrl);
   request.Content = content;
   
   // If you set header parameters, such as user metadata and storage class, when you generate the presigned URL, you must also send these parameters to the server when you use the presigned URL to upload the file. A signature error is reported if the parameters sent to the server are inconsistent with the signed parameters.
   // Set the request headers. The request header information must be the same as the information used when the URL was generated.
   request.Content.Headers.ContentType = new MediaTypeHeaderValue("text/plain") { CharSet = "utf8" };  // Specify the ContentType.       
   // Set the custom user metadata. The custom user metadata must be the same as the information used when the URL was generated.
   request.Content.Headers.Add("x-oss-meta-key1", "value1");
   request.Content.Headers.Add("x-oss-meta-key2", "value2");
   // Specify the storage class of the object.
   request.Content.Headers.Add("x-oss-storage-class", "Standard");
   
   // Print the request headers.
   Console.WriteLine("Request headers:");
   foreach (var header in request.Content.Headers)
   {
       Console.WriteLine($"{header.Key}: {string.Join(", ", header.Value)}");
   }
   
   // Send the request.
   var response = await httpClient.SendAsync(request);
   
   // Process the response.
   if (response.IsSuccessStatusCode)
   {
       Console.WriteLine($"Upload successful! Status code: {response.StatusCode}");
       Console.WriteLine("Response headers:");
       foreach (var header in response.Headers)
       {
           Console.WriteLine($"{header.Key}: {string.Join(", ", header.Value)}");
       }
   }
   else
   {
       string responseContent = await response.Content.ReadAsStringAsync();
       Console.WriteLine($"Upload failed! Status code: {response.StatusCode}");
       Console.WriteLine("Response content: " + responseContent);
   }

   C++

   #include <iostream>
   #include <fstream>
   #include <curl/curl.h>
   #include <map>
   #include <string>
   
   // Callback function to handle the HTTP response.
   size_t WriteCallback(void* contents, size_t size, size_t nmemb, std::string* output) {
       size_t totalSize = size * nmemb;
       output->append((char*)contents, totalSize);
       return totalSize;
   }
   
   void uploadFile(const std::string& signedUrl, const std::string& filePath, const std::map<std::string, std::string>& headers, const std::map<std::string, std::string>& metadata) {
       CURL* curl;
       CURLcode res;
       std::string readBuffer;
   
       curl_global_init(CURL_GLOBAL_DEFAULT);
       curl = curl_easy_init();
   
       if (curl) {
           // Set the URL.
           curl_easy_setopt(curl, CURLOPT_URL, signedUrl.c_str());
   
           // Set the request method to PUT.
           curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
   
           // Open the file.
           FILE* file = fopen(filePath.c_str(), "rb");
           if (!file) {
               std::cerr << "Unable to open file: " << filePath << std::endl;
               return;
           }
   
           // Set the file size.
           fseek(file, 0, SEEK_END);
           long fileSize = ftell(file);
           rewind(file);
   
           // Set the file read callback.
           curl_easy_setopt(curl, CURLOPT_READDATA, file);
           curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t)fileSize);
   
           // Set the request headers.
           struct curl_slist* chunk = nullptr;
           for (const auto& header : headers) {
               std::string headerStr = header.first + ": " + header.second;
               chunk = curl_slist_append(chunk, headerStr.c_str());
           }
           for (const auto& meta : metadata) {
               std::string metaStr = "x-oss-meta-" + meta.first + ": " + meta.second;
               chunk = curl_slist_append(chunk, metaStr.c_str());
           }
           curl_easy_setopt(curl, CURLOPT_HTTPHEADER, chunk);
   
           // Set the response handling callback.
           curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, WriteCallback);
           curl_easy_setopt(curl, CURLOPT_WRITEDATA, &readBuffer);
   
           // Execute the request.
           res = curl_easy_perform(curl);
   
           // Check the response.
           if (res != CURLE_OK) {
               std::cerr << "curl_easy_perform() failed: " << curl_easy_strerror(res) << std::endl;
           } else {
               long responseCode;
               curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &responseCode);
               std::cout << "Status code returned for the upload: " << responseCode << std::endl;
               if (responseCode == 200) {
                   std::cout << "Upload successful using network library." << std::endl;
               } else {
                   std::cout << "Upload failed." << std::endl;
               }
               std::cout << readBuffer << std::endl;
           }
   
           // Clean up.
           fclose(file);
           curl_slist_free_all(chunk);
           curl_easy_cleanup(curl);
       }
   
       curl_global_cleanup();
   }
   
   int main() {
       // Replace <signedUrl> with the authorized URL.
       std::string signedUrl = "<signedUrl>";
   
       // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
       std::string filePath = "C:\\Users\\demo.txt";
   
       // Set the request headers. The request header information must be the same as the information used when the URL was generated.
       std::map<std::string, std::string> headers = {
            {"Content-Type", "text/plain;charset=utf8"},
            {"x-oss-storage-class", "Standard"}
       };
   
       // Set the custom user metadata. The custom user metadata must be the same as the information used when the URL was generated.
       std::map<std::string, std::string> metadata = {
            {"key1", "value1"},
            {"key2", "value2"}
       };
   
       uploadFile(signedUrl, filePath, headers, metadata);
   
       return 0;
   }
   

   Android

   import android.os.AsyncTask;
   import android.util.Log;
   
   import java.io.DataOutputStream;
   import java.io.File;
   import java.io.FileInputStream;
   import java.io.IOException;
   import java.io.InputStream;
   import java.net.HttpURLConnection;
   import java.net.URL;
   import java.util.HashMap;
   import java.util.Map;
   import java.util.Map.Entry;
   
   public class SignUrlUploadActivity extends AppCompatActivity {
   
       private static final String TAG = "SignUrlUploadActivity";
   
       @Override
       protected void onCreate(Bundle savedInstanceState) {
           super.onCreate(savedInstanceState);
           setContentView(R.layout.activity_main);
   
           // Replace <signedUrl> with the authorized URL.
           String signedUrl = "<signedUrl>";
   
           // Specify the full path of the local file. If you do not specify a local path, the file is uploaded from the project path of the sample program by default.
           String pathName = "/storage/emulated/0/demo.txt";
   
           // Set the request headers. The request header information must be the same as the information used when the URL was generated.
           Map<String, String> headers = new HashMap<>();
           headers.put("Content-Type", "text/plain;charset=utf8");
           headers.put("x-oss-storage-class", "Standard");
   
           // Set the custom user metadata. The custom user metadata must be the same as the information used when the URL was generated.
           Map<String, String> userMetadata = new HashMap<>();
           userMetadata.put("key1", "value1");
           userMetadata.put("key2", "value2");
   
           new UploadTask().execute(signedUrl, pathName, headers, userMetadata);
       }
   
       private class UploadTask extends AsyncTask<Object, Void, Integer> {
           @Override
           protected Integer doInBackground(Object... params) {
               String signedUrl = (String) params[0];
               String pathName = (String) params[1];
               Map<String, String> headers = (Map<String, String>) params[2];
               Map<String, String> userMetadata = (Map<String, String>) params[3];
   
               try {
                   URL url = new URL(signedUrl);
                   HttpURLConnection connection = (HttpURLConnection) url.openConnection();
                   connection.setRequestMethod("PUT");
                   connection.setDoOutput(true);
                   connection.setUseCaches(false);
   
                   // Set the request headers.
                   for (Entry<String, String> header : headers.entrySet()) {
                       connection.setRequestProperty(header.getKey(), header.getValue());
                   }
   
                   // Set the custom user metadata.
                   for (Entry<String, String> meta : userMetadata.entrySet()) {
                       connection.setRequestProperty("x-oss-meta-" + meta.getKey(), meta.getValue());
                   }
   
                   // Read the file.
                   File file = new File(pathName);
                   FileInputStream fileInputStream = new FileInputStream(file);
                   DataOutputStream dos = new DataOutputStream(connection.getOutputStream());
   
                   byte[] buffer = new byte[1024];
                   int count;
                   while ((count = fileInputStream.read(buffer)) != -1) {
                       dos.write(buffer, 0, count);
                   }
   
                   fileInputStream.close();
                   dos.flush();
                   dos.close();
   
                   // Get the response.
                   int responseCode = connection.getResponseCode();
                   Log.d(TAG, "Status code returned for the upload: " + responseCode);
                   if (responseCode == 200) {
                       Log.d(TAG, "Upload successful using network library.");
                   } else {
                       Log.d(TAG, "Upload failed.");
                   }
   
                   InputStream is = connection.getInputStream();
                   byte[] responseBuffer = new byte[1024];
                   StringBuilder responseStringBuilder = new StringBuilder();
                   while ((count = is.read(responseBuffer)) != -1) {
                       responseStringBuilder.append(new String(responseBuffer, 0, count));
                   }
                   Log.d(TAG, responseStringBuilder.toString());
   
                   return responseCode;
               } catch (IOException e) {
                   e.printStackTrace();
                   return -1;
               }
           }
   
           @Override
           protected void onPostExecute(Integer result) {
               super.onPostExecute(result);
               if (result == 200) {
                   Toast.makeText(SignUrlUploadActivity.this, "Upload successful.", Toast.LENGTH_SHORT).show();
               } else {
                   Toast.makeText(SignUrlUploadActivity.this, "Upload failed.", Toast.LENGTH_SHORT).show();
               }
           }
       }
   }
   

Set an upload callback

When you upload a file, you can add callback parameters to automatically notify your application server after the upload is successful. For more information about the principles of callbacks, see Callback.

1. The bucket owner generates a pre-signed URL for a PUT request that includes upload callback parameters.

   Python

   import argparse
   import base64
   import requests
   import alibabacloud_oss_v2 as oss
   
   from datetime import datetime, timedelta
   
   # Create a command line parameter parser and describe the purpose of the script. The example describes how to generate a presigned URL that allows HTTP PUT requests.
   parser = argparse.ArgumentParser(description="presign put object sample")
   
   # Specify the command line parameters, including the required region, bucket name, endpoint, and object name.
   parser.add_argument('--region', help='The region in which the bucket is located.', required=True)
   parser.add_argument('--bucket', help='The name of the bucket.', required=True)
   parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS')
   parser.add_argument('--key', help='The name of the object.', required=True)
   
   def main():
       # Parse the command-line parameters.
       args = parser.parse_args()
   
       # Obtain access credentials from environment variables for authentication.
       credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()
   
       # Use the default configuration to create a cfg object and specify the credential provider.
       cfg = oss.config.load_default()
       cfg.credentials_provider = credentials_provider
   
       # Set the region attribute of the cfg object to the region provided in the command line.
       cfg.region = args.region
   
       # If a custom endpoint is provided, update the endpoint attribute of the cfg object with the provided endpoint.
       if args.endpoint is not None:
           cfg.endpoint = args.endpoint
   
       # Use the preceding configuration to initialize the OSSClient instance.
       client = oss.Client(cfg)
   
       # Specify a custom callback URL.
       call_back_url = "http://www.example.com/callback"
       # Construct the callback parameter: specify the callback URL and request body, and encode the parameters in Base64.
       callback=base64.b64encode(str('{\"callbackUrl\":\"' + call_back_url + '\",\"callbackBody\":\"bucket=${bucket}&object=${object}&my_var_1=${x:var1}&my_var_2=${x:var2}\"}').encode()).decode()
       # Define and Base64-encode custom callback variables.
       callback_var=base64.b64encode('{\"x:var1\":\"value1\",\"x:var2\":\"value2\"}'.encode()).decode()
   
       # Send the request to initiate a PUT request and generate a presigned URL for the specified object.
       pre_result = client.presign(oss.PutObjectRequest(
           bucket=args.bucket,  # Name of the bucket.
           key=args.key,  # Name of the object.
           callback=callback,
           callback_var=callback_var,
       ),expires=timedelta(seconds=3600)) # Specify the validity period of the request. In this example, the validity period is set to 3,600 seconds.
   
       # Display the method, expiration time, and presigned URL specified in the request to check the validity of the presigned URL.
       print(f'method: {pre_result.method},'
             f' expiration: {pre_result.expiration.strftime("%Y-%m-%dT%H:%M:%S.000Z")},'
             f' url: {pre_result.url}'
             )
   
       # Display the signed headers in the request, which are included in the HTTP header when the request is sent.
       for key, value in pre_result.signed_headers.items():
           print(f'signed headers key: {key}, signed headers value: {value}')
   
   # Call the main function to start the processing logic when the script is directly run.
   if __name__ == "__main__":
       main()  # Specify the entry point of the script. The control flow starts here.

   Go

   package main
   
   import (
   	"context"
   	"encoding/base64"
   	"encoding/json"
   	"flag"
   	"log"
   	"time"
   
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
   	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
   )
   
   // Define the global variables.
   var (
   	region     string // Region in which the bucket is located.
   	bucketName string // Name of the bucket.
   	objectName string // Name of the object.
   )
   
   // Specify the init function used to initialize command line parameters.
   func init() {
   	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
   	flag.StringVar(&bucketName, "bucket", "", "The name of the bucket.")
   	flag.StringVar(&objectName, "object", "", "The name of the object.")
   }
   
   func main() {
   	// Parse command line parameters.
   	flag.Parse()
   
   	// Check whether the name of the bucket is specified.
   	if len(bucketName) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, bucket name required")
   	}
   
   	// Check whether the region is specified.
   	if len(region) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, region required")
   	}
   
   	// Check whether the name of the object is specified.
   	if len(objectName) == 0 {
   		flag.PrintDefaults()
   		log.Fatalf("invalid parameters, object name required")
   	}
   
   	// Load the default configurations and specify the credential provider and region.
   	cfg := oss.LoadDefaultConfig().
   		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
   		WithRegion(region)
   
   	// Create an OSS client.
   	client := oss.NewClient(cfg)
   
   	// Specify the callback parameters.
   	callbackMap := map[string]string{
   		"callbackUrl":      "http://example.com:23450",                                                                   // Specify the URL of the callback server. Example: https://example.com:23450.
   		"callbackBody":     "bucket=${bucket}&object=${object}&size=${size}&my_var_1=${x:my_var1}&my_var_2=${x:my_var2}", // Specify the callback request body.
   		"callbackBodyType": "application/x-www-form-urlencoded",                                                          // Specify the type of the callback request body.
   	}
   
   	// Convert the configurations of the callback parameters to a JSON string and encode the string in Base64 to pass the callback configurations.
   	callbackStr, err := json.Marshal(callbackMap)
   	if err != nil {
   		log.Fatalf("failed to marshal callback map: %v", err)
   	}
   	callbackBase64 := base64.StdEncoding.EncodeToString(callbackStr)
   
   	callbackVarMap := map[string]string{}
   	callbackVarMap["x:my_var1"] = "thi is var 1"
   	callbackVarMap["x:my_var2"] = "thi is var 2"
   	callbackVarStr, err := json.Marshal(callbackVarMap)
   	if err != nil {
   		log.Fatalf("failed to marshal callback var: %v", err)
   	}
   	callbackVarBase64 := base64.StdEncoding.EncodeToString(callbackVarStr)
   
   	// Generate a presigned URL for the PutObject request.
   	result, err := client.Presign(context.TODO(), &oss.PutObjectRequest{
   		Bucket:      oss.Ptr(bucketName),
   		Key:         oss.Ptr(objectName),
   		Callback:    oss.Ptr(callbackBase64),    // Set the callback parameter, which is a Base64-encoded JSON string in this case.
   		CallbackVar: oss.Ptr(callbackVarBase64), // Specify custom parameters for the callback request, which is a Base64-encoded JSON string in this example. 
   	},
   		oss.PresignExpires(10*time.Minute),
   	)
   	if err != nil {
   		log.Fatalf("failed to put object presign %v", err)
   	}
   
   	log.Printf("request method:%v\n", result.Method)
   	log.Printf("request expiration:%v\n", result.Expiration)
   	log.Printf("request url:%v\n", result.URL)
   	if len(result.SignedHeaders) > 0 {
   		// If you specify request headers when you generate a signed URL that allows HTTP PUT requests, make sure that the request headers are included in the PUT request initiated by using the signed URL.
   		log.Printf("signed headers:\n")
   		for k, v := range result.SignedHeaders {
   			log.Printf("%v: %v\n", k, v)
   		}
   	}
   }
   

   Java

   import com.aliyun.oss.*;
   import com.aliyun.oss.common.auth.CredentialsProviderFactory;
   import com.aliyun.oss.common.auth.EnvironmentVariableCredentialsProvider;
   import com.aliyun.oss.common.comm.SignVersion;
   import com.aliyun.oss.internal.OSSHeaders;
   import com.aliyun.oss.model.GeneratePresignedUrlRequest;
   
   import java.net.URL;
   import java.text.SimpleDateFormat;
   import java.util.*;
   
   public class OssPresignExample {
       public static void main(String[] args) throws Throwable {
           // This example uses the public endpoint of the China (Hangzhou) region. Specify the actual endpoint.
           String endpoint = "https://oss-cn-hangzhou.aliyuncs.com";
           // Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured.
           EnvironmentVariableCredentialsProvider credentialsProvider = CredentialsProviderFactory.newEnvironmentVariableCredentialsProvider();
           // Specify the bucket name, for example, examplebucket.
           String bucketName = "examplebucket";
           // Specify the full path of the object, for example, exampleobject.txt. The full path of the object cannot contain the bucket name.
           String objectName = "exampleobject.txt";
           // Specify the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set the region to cn-hangzhou.
           String region = "cn-hangzhou";
   
           // Create an OSSClient instance.
           // When the OSSClient instance is no longer in use, call the shutdown method to release resources.
           ClientBuilderConfiguration clientBuilderConfiguration = new ClientBuilderConfiguration();
           clientBuilderConfiguration.setSignatureVersion(SignVersion.V4);
           OSS ossClient = OSSClientBuilder.create()
                   .endpoint(endpoint)
                   .credentialsProvider(credentialsProvider)
                   .clientConfiguration(clientBuilderConfiguration)
                   .region(region)
                   .build();
   
           URL signedUrl = null;
           try {
               // Construct the callback parameters.
               String callbackUrl = "http://www.example.com/callback";
               String callbackBody = "{\"callbackUrl\":\"" + callbackUrl + "\",\"callbackBody\":\"bucket=${bucket}&object=${object}&my_var_1=${x:var1}&my_var_2=${x:var2}\"}";
               String callbackBase64 = Base64.getEncoder().encodeToString(callbackBody.getBytes());
   
               String callbackVarJson = "{\"x:var1\":\"value1\",\"x:var2\":\"value2\"}";
               String callbackVarBase64 = Base64.getEncoder().encodeToString(callbackVarJson.getBytes());
               // Set the request headers.
               Map<String, String> headers = new HashMap<String, String>();
               // Specify CALLBACK.
               headers.put(OSSHeaders.OSS_HEADER_CALLBACK, callbackBase64);
               // Specify CALLBACK-VAR.
               headers.put(OSSHeaders.OSS_HEADER_CALLBACK_VAR, callbackVarBase64);
   
               // Set the expiration time (3600 seconds later).
               Date expiration = new Date(new Date().getTime() + 3600 * 1000);
   
               // Format the expiration time.
               SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
               dateFormat.setTimeZone(TimeZone.getTimeZone("UTC"));
               String expirationStr = dateFormat.format(expiration);
   
               // Construct the request.
               GeneratePresignedUrlRequest request = new GeneratePresignedUrlRequest(bucketName, objectName);
               request.setMethod(HttpMethod.PUT);
               request.setExpiration(expiration);
               // Add the request headers to the request.
               request.setHeaders(headers);
   
               // Print the callback and callback-var parameters.
               System.out.println("callback:"+callbackBase64);
               System.out.println("callback-var:"+callbackVarBase64);
   
               // Generate the presigned URL.
               URL url = ossClient.generatePresignedUrl(request);
   
               // Print the result.
               System.out.println("method: PUT,");
               System.out.println(" expiration: " + expirationStr + ",");
               System.out.println(" url: " + url);
   
           } catch (OSSException oe) {
               System.out.println("Caught an OSSException, which means your request made it to OSS, "
                       + "but was rejected with an error response for some reason.");
               System.out.println("Error Message:" + oe.getErrorMessage());
               System.out.println("Error Code:" + oe.getErrorCode());
               System.out.println("Request ID:" + oe.getRequestId());
               System.out.println("Host ID:" + oe.getHostId());
           } catch (ClientException ce) {
               System.out.println("Caught an ClientException, which means the client encountered "
                       + "a serious internal problem while trying to communicate with OSS, "
                       + "such as not being able to access the network.");
               System.out.println("Error Message:" + ce.getMessage());
           }
       }
   }

   PHP

   <?php
   
   // Include the autoload file to load dependencies.
   require_once __DIR__ . '/../vendor/autoload.php';
   
   use AlibabaCloud\Oss\V2 as Oss;
   
   // Define and describe command-line options.
   $optsdesc = [
       "region" => ['help' => 'The region in which the bucket is located.', 'required' => True], // (Required) Specify the region in which the bucket is located.
       "endpoint" => ['help' => 'The domain names that other services can use to access OSS.', 'required' => False], // (Optional) Specify the endpoint for accessing OSS.
       "bucket" => ['help' => 'The name of the bucket', 'required' => True], // (Required) Specify the name of the bucket.
       "key" => ['help' => 'The name of the object', 'required' => True], // (Required) Specify the name of the object.
   ];
   
   // Convert the descriptions to a list of long options required by getopt.
   // Add a colon (:) to the end of each option to indicate that a value is required.
   $longopts = \array_map(function ($key) {
       return "$key:";
   }, array_keys($optsdesc));
   
   // Parse the command-line options.
   $options = getopt("", $longopts);
   
   // Check whether the required options are configured.
   foreach ($optsdesc as $key => $value) {
       if ($value['required'] === True && empty($options[$key])) {
           $help = $value['help']; // Obtain help information.
           echo "Error: the following arguments are required: --$key, $help" . PHP_EOL;
           exit(1); // Exit the program if a required option is missing.
       }
   }
   
   // Assign the values parsed from the command-line options to the corresponding variables.
   $region = $options["region"]; // The region in which the bucket is located.
   $bucket = $options["bucket"]; // The name of the bucket.
   $key = $options["key"];       // The name of the object.
   
   // Load access credentials from environment variables.
   // Use EnvironmentVariableCredentialsProvider to retrieve the AccessKey ID and AccessKey secret from environment variables.
   $credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();
   
   // Use the default configuration of the SDK.
   $cfg = Oss\Config::loadDefault();
   $cfg->setCredentialsProvider($credentialsProvider); // Specify the credential provider.
   $cfg->setRegion($region); // Specify the region in which the bucket is located.
   if (isset($options["endpoint"])) {
       $cfg->setEndpoint($options["endpoint"]); // Specify the endpoint if one is provided.
   }
   
   // Create an OSSClient instance.
   $client = new Oss\Client($cfg);
   
   // Include the x-oss-callback and x-oss-callback-var headers.
   // Specify the callback URL.
   $call_back_url = "http://www.example.com/callback";
   
   // Construct callback parameters: Specify the callback URL and request body, both of which must be Base64-encoded.
   // Replace ${x:var1} and ${x:var2} with placeholders {var1} and {var2}.
   $callback_body_template = "bucket={bucket}&object={object}&my_var_1={var1}&my_var_2={var2}";
   $callback_body_replaced = str_replace(
       ['{bucket}', '{object}', '{var1}', '{var2}'],
       [$bucket, $key, 'value1', 'value2'],
       $callback_body_template
   );
   $callback = base64_encode(json_encode([
       "callbackUrl" => $call_back_url,
       "callbackBody" => $callback_body_replaced
   ]));
   
   // Define and Base64-encode custom callback variables.
   $callback_var = base64_encode(json_encode([
       "x:var1" => "value1",
       "x:var2" => "value2"
   ]));
   
   // Create a PutObjectRequest object to upload the data. 
   // Note that the Content-Type, metadata, and headers are included for signature calculation. 
   $request = new Oss\Models\PutObjectRequest(
       bucket: $bucket,
       key: $key,
       callback:$callback,
       callbackVar:$callback_var,
   );
   
   // Call the presign method to generate a presigned request.
   $result = $client->presign($request);
   
   // Display the presigned URL, which can be used to upload the specified object.
   print(
       'put object presign result:' . var_export($result, true) . PHP_EOL .
       'put object url:' . $result->url . PHP_EOL
   );
   

2. A third party uses the pre-signed URL for the PUT request to upload the file.

   curl

   curl -X PUT \
        -H "x-oss-callback: eyJjYWxsYmFja1VybCI6Imh0dHA6Ly93d3cuZXhhbXBsZS5jb20vY2FsbGJhY2siLCJjYWxsYmFja0JvZHkiOiJidWNrZXQ9JHtidWNrZXR9Jm9iamVjdD0ke29iamVjdH0mbXlfdmFyXzE9JHt4OnZhcjF9Jm15X3Zhcl8yPSR7eDp2YXIyfSJ9" \
        -H "x-oss-callback-var: eyJ4OnZhcjEiOiJ2YWx1ZTEiLCJ4OnZhcjIiOiJ2YWx1ZTIifQ==" \
        -T "C:\\Users\\demo.txt" \
        "https://exampleobject.oss-cn-hangzhou.aliyuncs.com/exampleobject.txt?x-oss-date=20241112T083238Z&x-oss-expires=3599&x-oss-signature-version=OSS4-HMAC-SHA256&x-oss-credential=LTAI****************%2F20241112%2Fcn-hangzhou%2Foss%2Faliyun_v4_request&x-oss-signature=ed5a******************************************************"

   Python

   import requests
   
   def upload_file(signed_url, file_path, headers=None):
       """
       Use a presigned URL to upload an object to OSS.
   
       :param signed_url: Presigned URL.
       :param file_path: Full path of the local file to be uploaded.
       :param headers: Request headers. This parameter is optional.
       :return: None
       """
       if not headers:
           headers = {}
   
       try:
           with open(file_path, 'rb') as file:
               response = requests.put(signed_url, data=file, headers=headers)
               print(f"Status code: {response.status_code}")
               if response.status_code == 200:
                   print("The object is uploaded using the library.")
               else:
                   print("Upload failed.")
               print(response.text)
       except Exception as e:
           print(f"An error occurred: {e}")
   
   if __name__ == "__main__":
       # Replace <signedUrl> with the presigned URL.
       signed_url = "<signedUrl>"
   
       # Specify the full path of the local file. By default, if you do not specify the full path of the local file, the local file is uploaded from the directory in which the script is stored.
       file_path = "C:\\Users\\demo.txt"
   
       headers = {
           "x-oss-callback": "eyJjYWxsYmFja1VybCI6Imh0dHA6Ly93d3cuZXhhbXBsZS5jb20vY2FsbGJhY2siLCJjYWxsYmFja0JvZHkiOiJidWNrZXQ9JHtidWNrZXR9Jm9iamVjdD0ke29iamVjdH0mbXlfdmFyXzE9JHt4OnZhcjF9Jm15X3Zhcl8yPSR7eDp2YXIyfSJ9",
           "x-oss-callback-var": "eyJ4OnZhcjEiOiJ2YWx1ZTEiLCJ4OnZhcjIiOiJ2YWx1ZTIifQ==",
       }
   
       upload_file(signed_url,  file_path, headers)

   Go

   package main
   
   import (
   	"bytes"
   	"fmt"
   	"io"
   
   	"net/http"
   	"os"
   )
   
   func uploadFile(signedUrl string, filePath string, headers map[string]string) error {
   	// Open the file.
   	file, err := os.Open(filePath)
   	if err != nil {
   		return err
   	}
   	defer file.Close()
   
   	// Read the content.
   	fileBytes, err := io.ReadAll(file)
   	if err != nil {
   		return err
   	}
   
   	// Create a request.
   	req, err := http.NewRequest("PUT", signedUrl, bytes.NewBuffer(fileBytes))
   	if err != nil {
   		return err
   	}
   
   	// Specify request headers.
   	for key, value := range headers {
   		req.Header.Add(key, value)
   	}
   
   	// Send the request.
   	client := &http.Client{}
   	resp, err := client.Do(req)
   	if err != nil {
   		return err
   	}
   	defer resp.Body.Close()
   
   	// Process the response.
   	fmt.Printf("Status code: %d\n", resp.StatusCode)
   	if resp.StatusCode == 200 {
   		fmt.Println("The object is uploaded using the library.")
   	} else {
   		fmt.Println("Upload failed.")
   	}
   	body, _ := io.ReadAll(resp.Body)
   	fmt.Println(string(body))
   
   	return nil
   }
   
   func main() {
   	// Replace <signedUrl> with the presigned URL.
   	signedUrl := "<signedUrl>"
   	// Specify the full path of the local file. If the path of the local file is not specified, the local file is uploaded from the path of the project to which the sample program belongs.
   	filePath := "C:\\Users\\demo.txt"
   
   	// Specify request headers. Make sure that the values of the request headers are the same as those specified when the presigned URL was generated.
   	headers := map[string]string{
   		"x-oss-callback":     "eyJjYWxsYmFja1VybCI6Imh0dHA6Ly93d3cuZXhhbXBsZS5jb20vY2FsbGJhY2siLCJjYWxsYmFja0JvZHkiOiJidWNrZXQ9JHtidWNrZXR9Jm9iamVjdD0ke29iamVjdH0mbXlfdmFyXzE9JHt4OnZhcjF9Jm15X3Zhcl8yPSR7eDp2YXIyfSJ9",
   		"x-oss-callback-var": "eyJ4OnZhcjEiOiJ2YWx1ZTEiLCJ4OnZhcjIiOiJ2YWx1ZTIifQ==",
   	}
   
   	err := uploadFile(signedUrl, filePath, headers)
   	if err != nil {
   		fmt.Printf("An error occurred: %v\n", err)
   	}
   }
   

   Java

   import org.apache.http.HttpEntity;
   import org.apache.http.client.methods.CloseableHttpResponse;
   import org.apache.http.client.methods.HttpPut;
   import org.apache.http.entity.FileEntity;
   import org.apache.http.impl.client.CloseableHttpClient;
   import org.apache.http.impl.client.HttpClients;
   import java.io.*;
   import java.net.URL;
   import java.util.*;
   
   public class SignUrlUpload {
       public static void main(String[] args) throws Throwable {
           CloseableHttpClient httpClient = null;
           CloseableHttpResponse response = null;
   
           // Replace <signedUrl> with the presigned URL.
           URL signedUrl = new URL("<signedUrl>");
   
           // Specify the full path of the local file. If the path of the local file is not specified, the local file is uploaded from the path of the project to which the sample program belongs.
           String pathName = "C:\\Users\\demo.txt";
   
           // Specify request headers, including x-oss-callback and x-oss-callback-var.
           Map<String, String> headers = new HashMap<String, String>();
           headers.put("x-oss-callback", "eyJjYWxsYmFja1VybCI6Imh0dHA6Ly93d3cuZXhhbXBsZS5jb20vY2FsbGJhY2siLCJjYWxsYmFja0JvZHkiOiJidWNrZXQ9JHtidWNrZXR9Jm9iamVjdD0ke29iamVjdH0mbXlfdmFyXzE9JHt4OnZhcjF9Jm15X3Zhcl8yPSR7eDp2YXIyfSJ9");
           headers.put("x-oss-callback-var", "eyJ4OnZhcjEiOiJ2YWx1ZTEiLCJ4OnZhcjIiOiJ2YWx1ZTIifQ==");
   
           try {
               HttpPut put = new HttpPut(signedUrl.toString());
               System.out.println(put);
               HttpEntity entity = new FileEntity(new File(pathName));
               put.setEntity(entity);
               // If you configure headers when the presigned URL was generated, these headers must be sent to the server when the presigned URL is used to upload a file. If the headers that are sent to the server for the signature calculation are different from the headers specified when the presigned URL was generated, a signature error is reported.
               for(Map.Entry header: headers.entrySet()){
                   put.addHeader(header.getKey().toString(),header.getValue().toString());
               }
   
               httpClient = HttpClients.createDefault();
   
               response = httpClient.execute(put);
   
               System.out.println("Status code: "+response.getStatusLine().getStatusCode());
               if(response.getStatusLine().getStatusCode() == 200){
                   System.out.println("The object is uploaded using the library.");
               }
               System.out.println(response.toString());
           } catch (Exception e){
               e.printStackTrace();
           } finally {
               response.close();
               httpClient.close();
           }
       }
   }       

   PHP

   <?php
   
   function uploadFile($signedUrl, $filePath, $headers = []) {
       // Check whether the file exists.
       if (!file_exists($filePath)) {
           echo "The file does not exist: $filePath\n";
           return;
       }
   
       // Initialize a cURL session.
       $ch = curl_init();
   
       // Set cURL options.
       curl_setopt($ch, CURLOPT_URL, $signedUrl);
       curl_setopt($ch, CURLOPT_PUT, true);
       curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
       curl_setopt($ch, CURLOPT_INFILE, fopen($filePath, 'rb'));
       curl_setopt($ch, CURLOPT_INFILESIZE, filesize($filePath));
       curl_setopt($ch, CURLOPT_HTTPHEADER, array_map(function($key, $value) {
           return "$key: $value";
       }, array_keys($headers), $headers));
   
       // Perform the cURL request.
       $response = curl_exec($ch);
   
       // Query the HTTP status code.
       $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
   
       // Close the cURL session.
       curl_close($ch);
   
       // Output the result
       echo "Status code: $httpCode\n";
       if ($httpCode == 200) {
           echo "The object is uploaded using the library.\n";
       } else {
           echo "Upload failed.\n";
       }
       echo $response . "\n";
   }
   
   // Replace <signedUrl> with the presigned URL.
   $signedUrl = "<signedUrl>";
   
   // Specify the full path of the local file. By default, if you do not specify the full path of the local file, the local file is uploaded from the directory in which the script is stored.
   $filePath = "C:\\Users\\demo.txt";
   
   $headers = [
       "x-oss-callback" => "eyJjYWxsYmFja1VybCI6Imh0dHA6Ly93d3cuZXhhbXBsZS5jb20vY2FsbGJhY2siLCJjYWxsYmFja0JvZHkiOiJidWNrZXQ9JHtidWNrZXR9Jm9iamVjdD0ke29iamVjdH0mbXlfdmFyXzE9JHt4OnZhcjF9Jm15X3Zhcl8yPSR7eDp2YXIyfSJ9",
       "x-oss-callback-var" => "eyJ4OnZhcjEiOiJ2YWx1ZTEiLCJ4OnZhcjIiOiJ2YWx1ZTIifQ==",
   ];
   
   uploadFile($signedUrl, $filePath, $headers);
   
   ?>

What is a pre-signed URL

A pre-signed URL is a secure link that grants temporary access to a specific OSS file using an encrypted signature and validity period verification. When a pre-signed URL is generated, an encrypted signature is calculated locally based on the AccessKey pair, resource path, expiration time, and other parameters. The signature parameter is then added to the URL to form the complete pre-signed URL. The typical format is: https://BucketName.Endpoint/Object?signature_parameters.

When a third party accesses this URL, OSS verifies the signature parameters. If the parameters have been tampered with or the URL has expired, access is denied.

The following is an example of a pre-signed URL.

https://examplebucket.oss-cn-hangzhou.aliyuncs.com/exampleobject.txt?x-oss-process=image%2Fresize%2Cp_10&x-oss-date=20241115T095058Z&x-oss-expires=3600&x-oss-signature-version=OSS4-HMAC-SHA256&x-oss-credential=LTAI****************%2F20241115%2Fcn-hangzhou%2Foss%2Faliyun_v4_request&x-oss-signature=6e7a********************************

This way, the bucket owner can securely authorize third-party access to files without exposing the AccessKey pair.

Scenarios

• Short-term file sharing: A third party requests to upload or download a specific file. The backend generates a pre-signed URL with a validity period and returns it to the frontend. The third party can use this URL to upload or download the file within the validity period, which ensures data security.

• Flexible access: The bucket owner can share the pre-signed URL through email or chat. A third party can then paste the URL into a browser's address bar to download the file.