Repair Signed URL Canonicalization

The problem

Signed URL verification often fails because signers and verifiers canonicalize request targets differently. Discrepancies in path encoding, query key ordering, or proxy headers lead to intermittent 403 errors or security bypasses.

What it does

• Identifies mismatches between signer and verifier canonicalization logic across the repository.
• Standardizes handling of percent-encoding, Unicode variants, and duplicate query keys.
• Hardens proxy trust gates by ensuring verification uses preserved request targets rather than reconstructed inputs.
• Generates byte-stable golden vectors and adversarial local fixtures for regression testing.
• Implements redacted observability to track verification failures without leaking sensitive tokens.

Frameworks & tools

Works with any web framework or proxy configuration including Nginx, AWS CloudFront, Express, Go, and Python. Uses Read, Edit, and Bash tools for repository-level repairs.

Why this beats prompting it yourself

General LLMs often suggest simple encoding fixes that break in production behind proxies. This skill enforces a strict resource register and canonical contract, ensuring that normalization logic is consistent across the entire request lifecycle.

Use cases

• Resolving 403 Forbidden errors caused by URL re-encoding in middleware.
• Securing webhook endpoints against host-header injection and request smuggling.
• Standardizing signature verification for APIs supporting complex query parameters.
• Debugging inconsistent verification between local development and staging environments.

Known limitations

Requires local repository access to signer and verifier source code. Cannot mutate live production infrastructure or rotate actual secrets.