action and allowPrefix you entered when applying for the temporary key are correct.cos.putObject(), but the action does not contain name/cos:PutObject, then there is no putObject permission, resulting in the error 403.1.jpg, but the allowPrefix is entered as test/* (only allowing operations on the test/* path), then there is no operation permission for the corresponding path, resulting in the error 403.action and allowPrefix are correct, see Generating and Using Temporary Keys and 403 Error for COS Access.
Field description: STS SDKs for different languages use different fields for action and allowPrefix, such as allowActions and allowPrefixes in the STS Java SDK. Be sure to check the examples in the STS SDK.ForcePathStyle:true can be used to enable suffixed request, and then only the URL of the real request is needed, which is in the following format:https://cos-ap-beijing.myqcloud.com/<BucketName-APPID>/<Key>
/<BucketName-APPID> will also be used in the signature calculation.cos.getObjectUrl.wx.downloadFile to download the image and get the temporary path.wx.saveImageToPhotosAlbum to save the image to the album.getAuthorization function do when Mini Programs use cos-wx-sdk-v5 to upload files to buckets?getAuthorization function in the Mini Program SDK to get a temporary key and sends it to the frontend for signature calculation. Then users can perform operations such as upload and deletion on the files according to the signature calculation result. We recommend that you use the temporary key mode to prevent disclosure of your key. For more information, see Mini Program SDK use case: Create a COS SDK instance.Feedback