signed-url icon indicating copy to clipboard operation
signed-url copied to clipboard

HTTPS not working

Open qeba opened this issue 4 years ago • 4 comments

Summary of the bug if the URL stored in https it cannot be used and become 404. but if you stored in http, it working.

To Reproduce store the URL in https:// and you will try to open the pages with the middleware you will get 404.

Suggestion of a fix maybe can make it check both HTTP and HTTPS.

qeba avatar Apr 25 '21 15:04 qeba

Hi @qeba, thanks a lot for your bug report! I believe this is intended - usually we would only want to let someone access a site over https and so the link will only work if you create it with the same protocol (http or https) you access it with.

Is your use-case that you want to create a link using https://, but let users access it over http://?

tobytwigger avatar Apr 25 '21 16:04 tobytwigger

Hi, the issues is when it saved as https:// in database it would not work both on http and https, but if you save it as http:// it works both http and https. If it saved as https:// - it will become not found.

qeba avatar Apr 26 '21 07:04 qeba

https://drive.google.com/file/d/1PaaL6J-6t-q8PVX66Zf6t3to3Ys2W2ux/view

Here is the video what i mean, when it stored as https its become not found, while if it save as http it works both. Or it is related to my webserver use, i use nginx is it effected?.

Thanks

qeba avatar Apr 26 '21 08:04 qeba

Hey @qeba , sorry for dropping this and thank you for your updates. I've had a look through the code but can't see any reason why https wouldn't be matched due to this library - it doesn't have any references to any protocol so should make no difference.

I've added a passing test (4a07288) to make sure the protocol isn't changed in the validation middleware

To rule it out for goot, you see what exception is thrown by turning on debug mode. If it's of type Linkeys\UrlSigner\Exceptions\LinkNotFoundException, then it is being caused by this library.

The other thing to check is what $request->getUri() gives you using an https:// link. It should be https://, and if it isn't that'll be what's causing the problem. Possibly a redirect on your nginx config?

tobytwigger avatar Aug 23 '21 21:08 tobytwigger