Secure authenticated image delivery with signed URLs#16
Merged
florianheysen merged 7 commits intomainfrom Feb 4, 2026
Merged
Conversation
…e TransformRequest interface
Contributor
There was a problem hiding this comment.
Pull request overview
This PR implements authenticated image delivery using HMAC-SHA256 signed URLs to prevent transformation abuse and unauthorized access, addressing the security concerns raised in issue #12. The implementation enhances the original work from PR #13 by upgrading from SHA-1 to HMAC-SHA256, adding path traversal protection, and centralizing signature logic.
Changes:
- Adds signed URL authentication system with HMAC-SHA256 signatures for secure media delivery
- Refactors transformation logic into a reusable TransformService to support both public and authenticated routes
- Removes GitHub Actions PR checks workflow (unrelated to feature)
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| apps/api/src/utils/signature.ts | New utility for HMAC-SHA256 signature generation, verification with timing-safe comparison, and path sanitization |
| apps/api/src/services/transform.service.ts | New service extracting transformation logic from routes for code reuse between public and authenticated endpoints |
| apps/api/src/routes/authenticated.ts | New authenticated route handler that validates signed URLs before processing transformations |
| apps/api/src/routes/transform.ts | Refactored to use TransformService, significantly simplified from ~336 to ~66 lines |
| apps/api/src/index.ts | Adds API_SECRET validation on startup and registers authenticated route with rate limiting |
| apps/api/env.template | Documents API_SECRET configuration requirements and signature format |
| .github/workflows/pr-checks.yml | Deleted GitHub Actions workflow for automated PR checks (lint, type-check, tests) |
Comments suppressed due to low confidence (1)
.github/workflows/pr-checks.yml:1
- The entire GitHub Actions workflow file for PR checks has been deleted. This appears unrelated to the authenticated image delivery feature. Unless this deletion is intentional and documented, it should not be part of this PR as it removes automated testing, linting, and type-checking for pull requests.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <[email protected]>
|
@florianheysen I've opened a new pull request, #21, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: Copilot <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR finalizes the authenticated image delivery flow introduced in #13, with stronger security guarantees.
It adds a signed URL mechanism for protected media, hardens the original implementation, and closes the requirements discussed in #12.
Closes #12
Summary
URL Format
/authenticated/s--{signature}/{transformations}/{filePath}Files
New
apps/api/src/utils/signature.tsUpdated
apps/api/src/routes/authenticated.tsapps/api/src/index.tsapps/api/env.templateNotes
As mentioned in #13, a follow-up could extend the upload flow to explicitly mark assets as authenticated-only.
Credits
Original work by @lancelotF, extended and secured in this PR.