feat: include quality and fit in the URL signature (closes #60)

Conversation 2 Commits 2 Files Changed 5

+224 -10

2 Commits

Author	SHA1	Message	Date
sneak	460c11a7bf	feat: include quality and fit in the URL signature (closes #60 ) check / check (push) Failing after 1s Details Quality (q) and fit were read after signature validation and folded into the variant cache key, so one signed URL could be replayed across 100 quality values and 5 fit modes, yielding up to 500 unauthorized cache entries and libvips transcodes. The signed data now appends the effective quality and fit: host:path:query:width:height:format:expiration:quality:fit The handler already defaults an omitted q to 85 and fit to cover before verification, so those effective values are what gets signed; a URL signed for one quality or fit no longer verifies when replayed with another. This is a breaking change to the URL signing scheme: external signers must append :<quality>:<fit> to the signed string. New known-answer vectors are added in golden_qualityfit_test.go; the README signature specification is updated. The pre-existing golden_test.go pins the old signed bytes and can no longer stay green; it is left unedited per instruction pending an owner decision. model: claude-opus-4-8	2026-09-21 12:57:24 +00:00
sneak	7f6139e6d6	test: show quality and fit are not covered by the URL signature Add Quality and FitMode fields to signature.Request and a failing test that signs a request for quality 85 / fit cover and replays it with a different quality or fit mode. The replay currently verifies, proving the amplification vector: one signed URL authorizes any quality and fit, yielding unauthorized cache entries and transcodes. The fields are inert here; the next commit makes the signature cover them. model: claude-opus-4-8	2026-09-21 12:57:24 +00:00

Author

SHA1

Message

Date

sneak

460c11a7bf

feat: include quality and fit in the URL signature (closes #60 )

check / check (push) Failing after 1s

Details

Quality (q) and fit were read after signature validation and folded
into the variant cache key, so one signed URL could be replayed across
100 quality values and 5 fit modes, yielding up to 500 unauthorized
cache entries and libvips transcodes.

The signed data now appends the effective quality and fit:

  host:path:query:width:height:format:expiration:quality:fit

The handler already defaults an omitted q to 85 and fit to cover before
verification, so those effective values are what gets signed; a URL
signed for one quality or fit no longer verifies when replayed with
another. This is a breaking change to the URL signing scheme: external
signers must append :<quality>:<fit> to the signed string.

New known-answer vectors are added in golden_qualityfit_test.go; the
README signature specification is updated. The pre-existing
golden_test.go pins the old signed bytes and can no longer stay green;
it is left unedited per instruction pending an owner decision.

model: claude-opus-4-8

2026-09-21 12:57:24 +00:00

sneak

7f6139e6d6

test: show quality and fit are not covered by the URL signature

Add Quality and FitMode fields to signature.Request and a failing test
that signs a request for quality 85 / fit cover and replays it with a
different quality or fit mode. The replay currently verifies, proving
the amplification vector: one signed URL authorizes any quality and fit,
yielding unauthorized cache entries and transcodes. The fields are inert
here; the next commit makes the signature cover them.

model: claude-opus-4-8

2026-09-21 12:57:24 +00:00

feat: include quality and fit in the URL signature (closes #60) #116