Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Serving jet staticfiles with Django storages adding "amp;" to query string params resulting in 403 unautharized access #93

Closed
Jihad opened this issue Sep 9, 2023 · 5 comments

Comments

@Jihad
Copy link

Jihad commented Sep 9, 2023

Not sure if this related to jet, but would love if anyone knows why?

Some staticfiles links have wrong params, what i noticed that they are only related to "django-jet" package.

Normal Django staticfiles URL:

https://daal.nyc3.digitaloceanspaces.com/static/css/admin.css?AWSAccessKeyId=****&Signature=***&Expires=1694226003

Django JET staticfiles URL:

https://daal.nyc3.digitaloceanspaces.com/static/jet/css/icons/style.css?AWSAccessKeyId=*****&Signature=*****&Expires=1694226003&v=1.3.3

This is causing request headers to have invalid names:
Signature is now "amp;Signature:" param causing the issues

Note sure what is causing this? I couldn't find out why

@foundyengineer
Copy link

any progress on this issue?

@Jihad
Copy link
Author

Jihad commented Dec 9, 2023

any progress on this issue?

Nope, I just made the few files public and avoided my problem the easy way like a champ :-)

@assem-ch
Copy link
Owner

assem-ch commented Dec 9, 2023

this seems related to jet_append_version , jet trying to add version to every static file url. this commit: 6f4d23f#diff-a8d0fb07c3ab9dd6f9081cfbfb42a61ac878f1dbaa26fa2d65532bd867c3ffaf

@assem-ch
Copy link
Owner

assem-ch commented Dec 9, 2023

@foundyengineer can you make static files public, I dont think they need to be as signed urls

@derkweijers
Copy link

derkweijers commented Mar 19, 2024

I was able to fix this by adding the following to my AWS/S3 config:
AWS_QUERYSTRING_AUTH = False

Hopefully this will help others as well!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants