Introduction
This article addresses an issue with Direct Cloud Storage Download in Artifactory (v7.98.x and later) where downloads fail with an HTTP 403 Forbidden error. This failure occurs specifically when using older versions of the wget client to download artifacts containing special characters, such as the plus sign (+).
Problem
In recent Artifactory versions (v7.98.x+), changes to how special characters are encoded in the response-content-disposition header of the S3 redirect URL cause older versions of wget to fail. While previous Artifactory versions (e.g. v7.90.x) used single-encoding, v7.98.x and above uses double-encoding, which triggers a legacy filename-handling bug in wget.
Symptoms
The initial request to Artifactory returns a 302 Found with a signed S3 URL.You will see the character double-encoded (e.g. %252B instead of %2B).
wget "https://artifactory-test.com/artifactory/generic-local/test-1.2.3+bac1.tar.gz"
--2026-01-28 00:17:15-- http://artifactory-test.com/artifactory/generic-local/test-1.2.3+bac1.tar.gz
Connecting to artifactory-test.com... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://test-bucket.s3.us-west-1.amazonaws.com/1768513172099/43/43a437c1ef94c11e5f0abb69ec6b7b49efab2bb6?X-Artifactory-username=anonymous&X-Artifactory-repoType=local&X-Artifactory-repositoryKey=generic-local&X-Artifactory-originPackageType=generic&X-Artifactory-packageType=generic&X-Artifactory-artifactPath=test-1.2.3%2Bbac1.tar.gz&X-Artifactory-originProjectKey=default&X-Artifactory-projectKey=default&X-Artifactory-originRepoType=local&X-Artifactory-originRepositoryKey=generic-local&x-jf-traceId=63bb229c39256879&response-content-disposition=attachment%3Bfilename%3D%22test-1.2.3%252Bbac1.tar.gz%22&response-content-type=application%2Fx-gzip&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20260128T001715Z&X-Amz-SignedHeaders=host&X-Amz-Expires=30&X-Amz-Credential=AKIAQQNUMFICMQF7T5H2%2F20260128%2Fus-west-1%2Fs3%2Faws4_request&X-Amz-Signature=54601f7556e0d0a4e5b4a90082fb85415b47efcd710b34339c2581545b01c799 [following]
…
Older wget clients (pre-v1.21.x) fail with a warning:
The name is too long, 835 chars total.
Trying to shorten...
The client truncates the URL string to create a "shortened" local filename, which inadvertently deletes the AWS Signature from the query string. The final response from S3 is an HTTP 403 Forbidden.
HTTP request sent, awaiting response... 403 Forbidden
Root Cause
The failure stems from a change in Artifactory's encoding behavior introduced in version v7.98.x:
- Pre v7.98.x (e.g. v7.90.x) (Single-Encoding): The + character is encoded as %2B. Older wget clients can parse this correctly.
- v7.98.x and later (Double-Encoding): The + character is double-encoded as %252B within the response-content-disposition header.
- The Conflict: Older versions of wget do not correctly interpret this double-encoded string within a redirect. It attempts to derive a filename from the entire string, exceeds its internal length limit, and "shortens" the URL. This truncation removes the X-Amz-Signature parameter, leading to the 403 Forbidden response from S3.
Resolution
Primary Fix: Upgrade wget
Upgrade wget to version 1.21.x or higher. Modern versions handle RFC-compliant double-encoding and long redirect URLs without attempting to truncate the URL string.
Alternative Fix: Disable Direct Cloud Download
If clients cannot be updated immediately, you can disable the feature for the specific repository to avoid the S3 redirect logic:
- Navigate to Administration > Repositories.
- Select the affected repository.
- Under the Advanced tab, uncheck Enable Redirect Download.