Signed URL returns invalid signature exception when used with Nginx | Laravel | Page 1

dusty ruin Apr 4, 2024, 5:45 AM

#

I've deployed my Laravel application to a Ubuntu VPS with Nginx. but unfortunately, signed URLs returns invalid signature exception.

Here is the Nginx configuration.

server {
    listen 80;
    listen [::]:80;
    server_name dasun.dev;
    root /var/www/html/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    index index.php;

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}

server {
    server_name dasun.dev;
    return 301 $scheme://www.dasun.dev$request_uri;
}

I was wondering if anyone could help resolve this.

urban shard Apr 4, 2024, 5:56 AM

#

You have two instances running for
server_name dasun.dev;
And you're redirecting to www.dasun.dev

What precisely are th e issues you're experiencing?

dusty ruin Apr 4, 2024, 5:58 AM

#

Hey Joe,

The second sever block for redirect non-www traffic to www.

So, simply when I visited to the signed url, I am getting the 403 error page.

urban shard Apr 4, 2024, 6:06 AM

#

Okay, so what's a normal URL, and a signed one

If you edit the file:
app/Http/Middleware/TrustProxies.php
and set

protected $proxies = "*";

And ensure it's enabled in
(app/Http/Kernel.php to enable it in $middleware)

Does that fix the 403?

#

Are you passing parameters into your signed URL (e.g. page_number/order_by)

dusty ruin Apr 4, 2024, 6:07 AM

#

I also tried with by wildcarding proxies, but i think there is no issue with proxies, since I am not behind a load balancer or reverse proxy.

urban shard Apr 4, 2024, 6:08 AM

#

Can you provide an example signed URL that isn't working?

dusty ruin Apr 4, 2024, 6:08 AM

#

Yeah.

#

https://www.dasun.dev/newsletter/confirm-subscription?email=hello%40dasun.dev&expires=1712212720&signature=247c4c6e8f582c43ce6e7e4c395d74b919e9b6e3c2997296f6a21b2a447314a8

urban shard Apr 4, 2024, 6:14 AM

#

As your Nginx is an HTTP, and you're sharing an HTTPS link, this can often cause a signature mismatch

dusty ruin Apr 4, 2024, 6:14 AM

#

Make sense.

#

How did you know the Nginx is HTTP?

urban shard Apr 4, 2024, 6:15 AM

#

server {
    listen 80;
    listen [::]:80;

#

So it's only listening on HTTP

#

You've got CloudFlare in front of it, so you do have a CDN/Load Balancer

#

In CloudFlare:
Generate an Origin Certificate key-pair
Add them to your server, and reference in your nginx config, and set your server to listen as 443 ssl, rather than 80

#

Then use CloudFlare to perform the http to https redirect for everything

dusty ruin Apr 4, 2024, 6:19 AM

#

okay, let me try this.

urban shard Apr 4, 2024, 6:23 AM

#

Finally check your APP_URL in your .env file and ensure it has the https prefix (rather than http)

dusty ruin Apr 4, 2024, 6:24 AM

#

APP_URL has https prefix, confirmed.

urban shard Apr 4, 2024, 6:28 AM

#

Once all of that is done, then it's likely to either be either:

Additional parameters present in the URL
TimeZone issues on the server (where the config app.timezone isn't set)

With your Route::get()
What does your validation/middleware look like?

#

Are you using hasValidSignature()?

dusty ruin Apr 4, 2024, 6:29 AM

#

Yes

#

i'm using the default middleware

urban shard Apr 4, 2024, 6:29 AM

#

Try changing it to:

hasValidSignatureWhileIgnoring(['email'])

dusty ruin Apr 4, 2024, 6:30 AM

#

But, the email is required to create the newsletter subscriber

urban shard Apr 4, 2024, 6:38 AM

#

Yep, it just ignores the email for signature purposes

dusty ruin Apr 4, 2024, 6:39 AM

#

Is there any way to decode the signature and see the payload?

urban shard Apr 4, 2024, 6:46 AM

#

Can you share the route where you're validating it plz

dusty ruin Apr 4, 2024, 6:47 AM

#

Route::get('/newsletter/unsubscribe', [NewsletterController::class, 'unsubscribe'])->name('newsletter.unsubscribe');

urban shard Apr 4, 2024, 6:48 AM

#

Okay, and the code where you're validating the signature

dusty ruin Apr 4, 2024, 6:48 AM

#

class NewsletterController extends Controller
{
    public function confirmSubscription(Request $request)
    {
        if (! $request->hasValidSignature()) {
            throw new InvalidSignatureException;
        }

        $newsletterSubscriberRepository = app(NewsletterSubscriberRepository::class);

        $newsletterSubscriberRepository->verifyEmail(
            email: $request->email
        );

        return view('newsletter.subscription-confirmed');
    }
}

urban shard Apr 4, 2024, 6:49 AM

#

In NewsletterController, what references do you have to Request in the namespace

dusty ruin Apr 4, 2024, 6:50 AM

#

use Illuminate\Http\Request;

urban shard Apr 4, 2024, 6:50 AM

#

have you added

use Illuminate\Http\Request;

Or is it using the Request facade?

#

Cool

dusty ruin Apr 4, 2024, 6:50 AM

#

This is working on my local.

urban shard Apr 4, 2024, 6:51 AM

#

It's likely the redirects/http vs https from CloudFlare tbh

dusty ruin Apr 4, 2024, 6:51 AM

#

And also, this was works with the production environment before. but I was using Octane.

#

So, now I use php-fpm

urban shard Apr 4, 2024, 6:51 AM

#

Just tested in a dev environment, and it's definitely working

#

With an Nginx/PHP-FPM environment

#

behind cloudflaer

#

cloudflare*

dusty ruin Apr 4, 2024, 6:52 AM

#

because, octane reserved 200mb - 300mb when running the application.

#

I am trying to setup Cloudflare certs.

#

seems, I am missing something.

#

ERR_TOO_MANY_REDIRECTS

urban shard Apr 4, 2024, 6:57 AM

#

Remove that second server in your nginx config

#

What does your nginx config look like for that site now

dusty ruin Apr 4, 2024, 6:57 AM

#

I did, and I am suprised.

#

Once, removed the 2nd Nginx block, another Laravel app got running which an open source project that I'm working

#

🤣

urban shard Apr 4, 2024, 6:59 AM

#

What does your first block look like now

#

If you're hitting another app, then you're not hitting that site/server definition, so it's reverting to the default/closest match

dusty ruin Apr 4, 2024, 7:00 AM

#

oh yeah, got it.

#

here is the niginx conf.

server {
    #listen 80;
    #listen [::]:80;
    listen 443;
    ssl on;
    ssl_certificate       /etc/ssl/dasun.dev.pem;
    ssl_certificate_key   /etc/ssl/dasun.dev.key;

    server_name dasun.dev;
    root /home/laravel/dasun.dev/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    index index.php;

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}

urban shard Apr 4, 2024, 7:04 AM

#

Okay, and you've reloaded/restarted nginx?

dusty ruin Apr 4, 2024, 7:04 AM

#

Yeah

urban shard Apr 4, 2024, 7:06 AM

#

server {
    listen  443 ssl;
    ssl_certificate       /etc/ssl/dasun.dev.pem;
    ssl_certificate_key   /etc/ssl/dasun.dev.key;

    server_name dasun.dev www.dasun.dev;
    root /home/laravel/dasun.dev/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";

    index index.php;

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    location ~ \.php$ {
        proxy_set_header REMOTE_ADDR $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}

dusty ruin Apr 4, 2024, 7:10 AM

#

let me try.

urban shard Apr 4, 2024, 7:10 AM

#

Do you have any other redirects enabled in Cloudflare?
Any packages/.htaccess etc to try and redirect http to https?
Do you see any requests hitting other sites?

find /etc/nginx/sites-enabled/* |  xargs grep 'server_name dasun.dev'

Just get the one result?

#

Likewise for:

find /etc/nginx/sites-enabled/* |  xargs grep 'server_name www.dasun.dev'

#

Also, can you share the route for "newsletter/confirm-subscription", which you shared earlier when you get a mo, as you shared the "unsubscribe" route

dusty ruin Apr 4, 2024, 7:15 AM

#

just a moment.

urban shard Apr 4, 2024, 7:16 AM

#

At a glance, it looks like you're looping around the params at the mo, so there's some looping going on somewhere, most likely within your nginx environment, or Cloudflare

Swapping out "fastcgi_param SCRIPT_FILENAME...." with

        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;

MAY work more smoothly btw (mixed opinions online)

dusty ruin Apr 4, 2024, 7:18 AM

#

Hey, it works without the 2nd server block.

urban shard Apr 4, 2024, 7:18 AM

#

Woo

#

Let CloudFlare handle any redirecting from HTTP to HTTPS, non-www to www etc

dusty ruin Apr 4, 2024, 7:19 AM

#

yeah, even keeping the same first server block

urban shard Apr 4, 2024, 7:19 AM

#

Nice!

dusty ruin Apr 4, 2024, 7:19 AM

#

yeah, I am deleting ssl certs from server. no need anymore

urban shard Apr 4, 2024, 7:19 AM

#

Always worth doing

#

End to End SSL is always best, but if it's something you're not too fussed about, then that's fine too

#

Having everything consistent prevents issues down the line too

dusty ruin Apr 4, 2024, 7:21 AM

#

one more thing, I still wanted to be redirected to non-www to www.

#

now everything is working except this.

#

anyways, marking this thread as solved.

#

the redirection created on cloudflare, now everthing looks good.

https://community.cloudflare.com/t/redirect-the-www-to-non-www/558655

#Signed URL returns invalid signature exception when used with Nginx