Invalid Signature on Uploads (Happens intermittently)

Pet Giving

May 29, 2020 19:11 Edited

 

We're seeing this happen intermittently.  It appeared to happen on the 1st chunk of the multi part request.  Any advice?

 

Here's my code for creating the sig

public function generateCloudinarySignature($uuid)
{
    $timestamp = time();
    $params = [
        'public_id' => $uuid,
        'source' => 'uw',
        'timestamp' => $timestamp,
        'upload_preset' => 'overwrite_videos'
    ];
    $signature = Cloudinary::api_sign_request($params, env('CLOUDINARY_API_SECRET'));
    return $signature;
}

 

Note - we're using the cloudinary widget.  And make an async call to generate the sig as soon as the widget gets opened.  One idea was to maybe not generate the sig with async call, but to pass it in on page load, but we weren't sure how this would effect things if we try to upload many times with the same sig.

0

• 

  Michal Kuperman

  May 31, 2020 13:30

  Hi, Can you please check that the params you used to sign (specifically public_id, timestamp) match the params you get in the error? In addition, please check that you are using the correct api_secret as well.

  0
• 

  Pet Giving

  June 03, 2020 16:04 Edited

  There's a 1 second difference between the timestamp I create and the one that comes back in the error msg.  Why might this be? 

   

  EDIT - figured out is just a hash comparison. I'm assuming the timestamp from the sig gets compared to the created_at property generated in the widget.  Any suggestions?

  0
• 

  Shirly Manor

  June 04, 2020 19:27 Edited

  Hi,

  Looking at the string to sign:
  
  
   'public_id=909be419-5d43-43f5-b5a9-a78e6222cd87&source=uw&timestamp=1591295003&upload_preset=overwrite_videos'

   

  And it seems that we missed the API Secret at the end of the string.

  If your API Secret is `abcd` It should look like:

   'public_id=909be419-5d43-43f5-b5a9-a78e6222cd87&source=uw&timestamp=1591295003&upload_preset=overwrite_videosabcd'

  You can read more about it here:

  https://cloudinary.com/documentation/upload_images#generating_authentication_signatures

  Please let us know if that helps,

  0
• 

  Pet Giving

  June 04, 2020 19:34 Edited

  This doesn't help.  We using the official Cloudinary to generate the SHA1 hash.  The string in the error isn't what we send  HASH's can't be decrypted.

   

  Also your comment doesn't explain why it works most of the time.

  0
• 

  Shirly Manor

  June 05, 2020 16:54

  Hi, 

  For security reasons, can you please open a ticket at support@cloudinary.com and we can check this issue together?

  Best,

  0

Post is closed for comments.