assem-ch / django-jet-reboot

Legacy Django jet rebooted to support Django > 3 (4 and 5), and latest python releases
https://django-jet-reboot.readthedocs.io/
GNU Affero General Public License v3.0
399 stars 65 forks source link

Serving jet staticfiles with Django storages adding "amp;" to query string params resulting in 403 unautharized access #93

Closed Jihad closed 3 weeks ago

Jihad commented 1 year ago

Not sure if this related to jet, but would love if anyone knows why?

Some staticfiles links have wrong params, what i noticed that they are only related to "django-jet" package.

Normal Django staticfiles URL:

https://daal.nyc3.digitaloceanspaces.com/static/css/admin.css?AWSAccessKeyId=****&Signature=***&Expires=1694226003

Django JET staticfiles URL:

https://daal.nyc3.digitaloceanspaces.com/static/jet/css/icons/style.css?AWSAccessKeyId=*****&Signature=*****&Expires=1694226003&v=1.3.3

This is causing request headers to have invalid names: Signature is now "amp;Signature:" param causing the issues

Note sure what is causing this? I couldn't find out why

foundyengineer commented 10 months ago

any progress on this issue?

Jihad commented 9 months ago

any progress on this issue?

Nope, I just made the few files public and avoided my problem the easy way like a champ :-)

assem-ch commented 9 months ago

this seems related to jet_append_version , jet trying to add version to every static file url. this commit: https://github.com/assem-ch/django-jet-reboot/commit/6f4d23f05eba8b48279502ae84bcb25df09aa341#diff-a8d0fb07c3ab9dd6f9081cfbfb42a61ac878f1dbaa26fa2d65532bd867c3ffaf

assem-ch commented 9 months ago

@foundyengineer can you make static files public, I dont think they need to be as signed urls

derkweijers commented 6 months ago

I was able to fix this by adding the following to my AWS/S3 config: AWS_QUERYSTRING_AUTH = False

Hopefully this will help others as well!