-
Notifications
You must be signed in to change notification settings - Fork 3.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use fnv1a instead of SHA256 to create images signatures #2353
Conversation
The latest updates on your projects. Learn more about Argos notifications ↗︎
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We can't just ship this as it'll break all images at the moment. We need a compatibility layer
@SamyPesse Done in 2a7104e |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks good, but we should test urls on preview url to ensure previous urls still work
Testing old images URLs using the previous algorithm from another deployment:
Using a deployment from this branch with the old algorithm:
New URL from this branch (new algorithm):
|
Because we use a private key alongside the URLs to sign server side, using a simpler and non-cryptographic hashing function such as
fnv1a
that can't be reversed should be secure enough.It should eventually yield to way faster rendering on pages that have many images because we potentially compute these hashes for each image, and it will also make the resize endpoint faster too, since we need to recompute the hash there.