问cos-js-sdk-v5中的getObjectUrl私有化问题？

使用临时令牌创建了一个cos，然后进行 getObjectUrl 那个桶是写入和读取都是私有的，现在问题是返回403,参数里签名设为

Sign: true,

cosClient里action是

'name/cos:GetObject',

'name/cos:PutObject',

'name/cos:DeleteObject'

签名是这个

sign=q-sign-algorithm%3Dsha1%26q-ak%3DAKIDer1GwHeh4OR1XYTwym5fv9THJEFjpjGD%26q-sign-time%3D1533901056%3B1533901956%26q-key-time%3D1533901056%3B1533901956%26q-header-list%3D%26q-url-param-list%3D%26q-signature%3Da6c979b9aa0aced81baf796da8ab46c9743a8c2d&x-cos-security-token=d0263ea68386a582e5778c1a12914e94592ddb0330001