Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix the documentation for the sign parameter #5

Merged
merged 3 commits into from
Sep 5, 2024
Merged

Fix the documentation for the sign parameter #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5e61877
Fix the documentation for the sign parameter
MathieuLegault1 Jan 9, 2024
e7facbf
add missing test
MathieuLegault1 Jan 17, 2024
aef139b
inspect
MathieuLegault1 Jan 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,17 +70,17 @@ Then a request path like:

will fail because the `sign` parameter is not present.

**The HMAC-SHA256 hash is created by taking the URL path (including the leading /), the request parameters (alphabetically-sorted and concatenated with & into a string). The hash is then base64url-encoded.**
**The HMAC-SHA256 hash is created by taking the URL path (excluding the leading /), the request parameters (alphabetically-sorted and concatenated with & into a string). The hash is then base64url-encoded.**
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That’s weird because it breaks the imaginary lib: https://github.com/h2non/imaginary?tab=readme-ov-file#url-signature.

I think we should maintain this contract by fixing this lib and making a major version release.

Can you add a test that shows the bug?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason we want to stay compliant with h2non/imaginary ? I don't see any mention of that lib in the plug_image_processing project. But yeah I don't mind changing this lib to keep it. I'll add a test for it !

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added a test that demonstrate that the "/" is excluded. I'll change the code (and the test) after you give me a 👍 that we want that !

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like it’s in the repository’s description and tags only:

But we should definitely make it more obvious in README.md 😁


```elixir
Base.url_encode64(:crypto.mac(:hmac, :sha256, "1234", "/resize" <> "quality=60&url=https://s3.ca-central-1.amazonaws.com/my_image.jpg&width=300"))
# => "O8Xo9xrP0fM67PIWMIRL2hjkD_c5HzzBtRLfpo43ENY="
Base.url_encode64(:crypto.mac(:hmac, :sha256, "1234", "resize" <> "quality=60&url=https://s3.ca-central-1.amazonaws.com/my_image.jpg&width=300"))
# => "ku5SCH56vrsqEr-_VRDOFJHqa6AXslh3fpAelPAPoeI="
```

Now this request will succeed!

```sh
/imageproxy/resize?url=https://s3.ca-central-1.amazonaws.com/my_image.jpg&width=300&quality=60&sign=O8Xo9xrP0fM67PIWMIRL2hjkD_c5HzzBtRLfpo43ENY=
/imageproxy/resize?url=https://s3.ca-central-1.amazonaws.com/my_image.jpg&width=300&quality=60&sign=ku5SCH56vrsqEr-_VRDOFJHqa6AXslh3fpAelPAPoeI=
```

## License
Expand Down
14 changes: 14 additions & 0 deletions test/plug_image_processing/plug_image_processing_test.exs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,19 @@ defmodule PlugImageProcessingTest do

assert url === "http://example.com/imageproxy/resize?url=http%3A%2F%2Fbucket.com%2Ftest.jpg&width=10"
end

test "valid with signature", %{config: config} do
url_signature_key = "12345"
config = Keyword.put(config, :url_signature_key, url_signature_key)

url = PlugImageProcessing.generate_url("http://example.com", config, :resize, %{url: "http://bucket.com/test.jpg", width: 10})

assert url ===
"http://example.com/imageproxy/resize?url=http%3A%2F%2Fbucket.com%2Ftest.jpg&width=10&sign=#{generate_signature_from_url(url_signature_key, "resizeurl=http%3A%2F%2Fbucket.com%2Ftest.jpg&width=10")}"
end
end

defp generate_signature_from_url(url_signature_key, url) do
Base.url_encode64(:crypto.mac(:hmac, :sha256, url_signature_key, url))
end
end
Loading