Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix the documentation for the sign parameter #5

Merged
merged 3 commits into from
Sep 5, 2024

Conversation

MathieuLegault1
Copy link
Contributor

Even thought the documentation says that you should include the leading "/" in practice you need to exclude it.

  def generate_signature(url, config) do
    uri = URI.parse(url)
    url_path = uri.path
    url_path = String.trim_leading(url_path, config.path <> "/") # This is removing the leading /

    url_query =
      uri.query
      |> URI.decode_query()
      |> Enum.sort_by(fn {key, _} -> key end)
      |> Map.new()
      |> Map.drop(["sign"])
      |> URI.encode_query()

    Base.url_encode64(:crypto.mac(:hmac, :sha256, config.url_signature_key, url_path <> url_query))
  end

Even thought the documentation says that you should include the leading "/" in practice you need to exclude it
@@ -70,17 +70,17 @@ Then a request path like:

will fail because the `sign` parameter is not present.

**The HMAC-SHA256 hash is created by taking the URL path (including the leading /), the request parameters (alphabetically-sorted and concatenated with & into a string). The hash is then base64url-encoded.**
**The HMAC-SHA256 hash is created by taking the URL path (excluding the leading /), the request parameters (alphabetically-sorted and concatenated with & into a string). The hash is then base64url-encoded.**
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That’s weird because it breaks the imaginary lib: https://github.com/h2non/imaginary?tab=readme-ov-file#url-signature.

I think we should maintain this contract by fixing this lib and making a major version release.

Can you add a test that shows the bug?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason we want to stay compliant with h2non/imaginary ? I don't see any mention of that lib in the plug_image_processing project. But yeah I don't mind changing this lib to keep it. I'll add a test for it !

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added a test that demonstrate that the "/" is excluded. I'll change the code (and the test) after you give me a 👍 that we want that !

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like it’s in the repository’s description and tags only:

But we should definitely make it more obvious in README.md 😁

@simonprev simonprev merged commit 4bb9a7f into master Sep 5, 2024
2 checks passed
@simonprev simonprev deleted the fix/readme-documentation branch September 5, 2024 02:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants