Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix the documentation for the sign parameter #5

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

MathieuLegault1
Copy link

Even thought the documentation says that you should include the leading "/" in practice you need to exclude it.

  def generate_signature(url, config) do
    uri = URI.parse(url)
    url_path = uri.path
    url_path = String.trim_leading(url_path, config.path <> "/") # This is removing the leading /

    url_query =
      uri.query
      |> URI.decode_query()
      |> Enum.sort_by(fn {key, _} -> key end)
      |> Map.new()
      |> Map.drop(["sign"])
      |> URI.encode_query()

    Base.url_encode64(:crypto.mac(:hmac, :sha256, config.url_signature_key, url_path <> url_query))
  end

Even thought the documentation says that you should include the leading "/" in practice you need to exclude it
@@ -70,17 +70,17 @@ Then a request path like:

will fail because the `sign` parameter is not present.

**The HMAC-SHA256 hash is created by taking the URL path (including the leading /), the request parameters (alphabetically-sorted and concatenated with & into a string). The hash is then base64url-encoded.**
**The HMAC-SHA256 hash is created by taking the URL path (excluding the leading /), the request parameters (alphabetically-sorted and concatenated with & into a string). The hash is then base64url-encoded.**
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That’s weird because it breaks the imaginary lib: https://github.com/h2non/imaginary?tab=readme-ov-file#url-signature.

I think we should maintain this contract by fixing this lib and making a major version release.

Can you add a test that shows the bug?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason we want to stay compliant with h2non/imaginary ? I don't see any mention of that lib in the plug_image_processing project. But yeah I don't mind changing this lib to keep it. I'll add a test for it !

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added a test that demonstrate that the "/" is excluded. I'll change the code (and the test) after you give me a 👍 that we want that !

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like it’s in the repository’s description and tags only:

But we should definitely make it more obvious in README.md 😁

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants