Intermittent Carrierwave S3 403 Signature Does Not Match errors

Question

I am getting seemingly random erorrs when uploading files to s3 from my app on heroku. I am using jquery-file-upload to upload pictures to a tmp/ directory in my bucket using the CORS method and this code.

  def url
    temp_url = AWS::S3::S3Object.url_for(
      s3_key,
      S3_CONFIG['bucket'],
      use_ssl: true)
    puts temp_url
    temp_url
    # temp_url.to_s.encode_signs
  end

  def delete_photo_from_s3
    begin
      photo = AWS::S3::S3Object.find(s3_key, S3_CONFIG['bucket'])
      photo.delete
    rescue Exception => e
      Rails.logger.error e.message
    end
  end

  private

  def s3_key
    parent_url = self[:uri]
    # If the url is nil, there's no need to look in the bucket for it
    return nil if parent_url.nil?
    # This will give you the last part of the URL, the 'key' params you need
    # but it's URL encoded, so you'll need to decode it
    object_key = parent_url.split(/\//)
    "#{object_key[3]}/#{object_key[4]}/#{object_key[5]}"
  end

From there I am using carrierwave to upload and process these images. However, sometimes the uploads fail silently and I am getting 403 Forbidden errors in my s3 bucket. Not sure what is causing this.

From there, I am using Qu to process a background job to attach the image to carrierwave using the remote__url call. Here is my background task:

class PhotoUploader
  def self.perform(finding_id, photo_id)
    begin
      finding = Finding.find(finding_id)
      photo = Photo.find(photo_id)
      upload = finding.uploads.build
      # attached_picture = photo.temp_image_url || photo.url
      upload.remote_attachment_url = photo.url
      if upload.save!
        Rails.logger.debug "#{Time.now}: Photo #{photo_id} saved to finding..."
        photo.set(:delete_at => 1.hour.from_now)  # UTC, same as GMT (Not local time!)
        photos = Photo.where(:processing => true, :delete_at.lte => Time.now.utc)  # Query for UTC time, same type as previous line (also not local time!)
        finding.unset(:temp_image)
        if photos
          photos.each do |photo|
            photo.destroy
            Rails.logger.debug "Photo #{photo.id} - #{photo.uri} destroyed."
          end
        end
      else
        raise "Could not save to s3!"
      end
    rescue Exception => e
      Rails.logger.debug "#{Time.now}: PH01 - Error processing photo #{photo_id}, trying again... :: #{e.message}"
      retry
    end
  end
end

This works sometimes, but not always, which is really wierd. I end up getting a bunch of these errors in my s3 logs:

fc96aee492e463ff67c0a9835c23c81a09c4c36a53cdf297094ded3a7d02c62f actionlog-development [02/Dec/2012:20:27:18 +0000] 71.205.197.214 - 625CEFB5DB7867A7 REST.GET.OBJECT tmp/4f75d2fb4e484f2ffd000001/apcm_photomix1_0022.jpg "GET /actionlog-development/tmp/4f75d2fb4e484f2ffd000001/apcm_photomix1_0022.jpg?AWSAccessKeyId=AKIAI___ZA6A&Expires=1354480332&Signature=4wPc+nT84WEdOuxS6+Ry4iMNkys= HTTP/1.1" 403 SignatureDoesNotMatch 895 - 8 - "-" "Ruby" -

I have read about this a lot and it seems that people get this issue sometimes when there are unescaped '+'s in the signature. I'm not sure if this is a Carrierwave, Fog, or AWS::S3 issue.

If you could provide any assistance with this, it would be greatly appreciated.

Thanks.

I found a workaround. First, make sure that your server's system time is accurate. This can cause 'Time too skewed' errors from AWS. Then add this to your carrierwave uploader def process_uri(uri) URI.parse(uri) end This will override the default carrierwave url parser, which I think is bugged. You can read more about this issue here github.com/carrierwaveuploader/carrierwave/issues/700 — Bramanga

Marcus Derencius Marcus Derencius · Accepted Answer · 2015-01-22T13:24:27

Better use the v4 signature, that should prevent this kind of error. Just add the option "signature_version: :v4" to the url_for call.

temp_url = AWS::S3::S3Object.url_for(
  s3_key,
  S3_CONFIG['bucket'],
  use_ssl: true,
  signature_version: :v4)

Intermittent Carrierwave S3 403 Signature Does Not Match errors

2 Answers