Invalid auth signature provided Exception

[irazasyed]

So I have a search engine built into my app that fetches results from multiple sources from across the web from different engines and broadcasts the results in real-time as we get a response.

I was using laravel-echo-server earlier and it was all good. I migrated to this package and have been facing this issue. At first, I thought it could be a third-party issue and tested the APIs and everything else but it seems like everything is fine at that end but when it's broadcasting results in a loop, it shows this error for few broadcasts.

What you think could be breaking the flow and causing this issue? I'm sending JSON payload of results after we've parsed and transformed as per the format we need on the front-end.

Exception `Symfony\Component\HttpKernel\Exception\HttpException` thrown: `Invalid auth signature provided.`

[irazasyed]

FYI, I have no other issues with the package and other issues for which I had, I've sent PRs for it. Everything else and other parts of the app works fine. Just this part I'm having trouble and there are no logs for some reason. So it's quite challenging to debug the issue.

[coolcodemy]

Inside WebSockets/Channels/Channel.php, you have verifySignature method. It is trying to compare hash_hmac of the payload and app's secret. This will fail because $payload->auth take the value inside config/broadcasting.php. But the hash_hmac('sha256', $signature, $connection->app->secret) returns the value for the app you are currently selecting.

[mattiasgeniar]

I can confirm we're seeing the same behaviour: for some of our events, we're getting this invalid auth signature;

{"error":"Invalid auth signature provided."} {"exception":"[object] (Illuminate\\Broadcasting\\BroadcastException(code: 0): {\"error\":\"Invalid auth signature provided.\"}

[stayallive]

I think this might be caused by the signatures not being validated correctly according to what the Pusher server does, might be fixed with #38.

[irazasyed]

@stayallive I tested your code and unfortunately, It's throwing that exception for every event now instead of specific ones so that has not resolved the issue rather introduced a new one.

[coolcodemy]

@irazasyed checkout my PR #39

[irazasyed]

@coolcodemy That didn't resolve the issue either plus it's not specific to dashboard related events or auth.

[coolcodemy]

@irazasyed oopss. sorry. That fix was for invalid signature. I've read it wrong.

[stayallive]

I am seeing that too... this has to do with the route params being added as query parameter causing the validation to fail... damn. Back to the drawing board...

[irazasyed]

So I've been debugging this issue all day today and here are a few things I found that may help us get to the root:

• When this invalid signature issue occurs, the request body is null/empty even tho there is data.
• I increased the max request kb just in case my payload might've become huge but it still failed.
• Modified my data that was being broadcast and it works. The data that was removed from the payload was the links that were urlencoded and had various chars in them. Tested with decoded links and every other ways but it always failed. However, Other data with links also worked fine. But when I was using laravel-echo-server with the same data, it always used to work fine. So something here somewhere is discarding the request body due to which it's causing this issue. Any pointers would be good?

[mattiasgeniar]

Any pointers would be good?

Would you be able to provide the payload that got dropped?

There are various json_encode's in the code, if that fails to encode properly it'll return false and might cause an empty body. But, in order to troubleshoot, the exact payload would be useful.

[harrynewsome]

• Modified my data that was being broadcast and it works.

Experiencing this same issue and can confirm changing the data being broadcast fixes the issue.

[mattiasgeniar]

@harrynewsome do you happen to have an example of a payload in the broadcast that reliably causes the issue?

[ulfie22]

I have the web socket server talking to three deployments of my code (one server with three socket apps defined). For my local and staging servers, it is working well. For my production server, I am getting the Invalid auth signature provided error on every broadcast attempt. I am using private channels and I see the auth request hit my Laravel server. In the socket server dashboard, I never see my app successfully occupied and subscribed to the channel (as it does in the other deployments). The same type of data is being sent as the payload in all three deployments so I don't think it's anything there. This is a real showstopper for me - any thoughts how to get around this?

On the actual socket server, there is an error in the log for each request: Exception `BeyondCode\LaravelWebSockets\WebSockets\Exceptions\InvalidSignature` thrown: `Invalid Signature` 661879: exception `BeyondCode\LaravelWebSockets\WebSockets\Exceptions\InvalidSignature` thrown: `Invalid Signature`.