Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+17 more

    Repair Signed URL Canonicalization

    1

    Repair signed URL verification failures and bypasses caused by inconsistent path, query, percent-encoding, Unicode, host, port, method, duplicate-parameter, or proxy normalization.

    $8.99

    30-day refund guarantee

    Secure checkout via Stripe

    0 installsSecurity scanned

    See it in action

    You say

    Our Go download signer signs URL.EscapedPath and ordered query pairs, but verification rebuilds the URL from router params and url.Values, which decodes the path and sorts duplicate keys. Repair with golden vectors and local requests. Preserve HMAC, key IDs, expiry, nonce policy, proxy trust, and errors.

    Your agent does

    Canonical-input defect found. Verification reconstructs a semantic URL rather than authenticating the same byte-level request target used by the signer, collapsing duplicate query pairs and changing escaped path bytes. The repair defines one versioned canonical byte format shared by signer/verifier, gates proxy-derived authority through existing trust policy, preserves HMAC/key/expiry/nonce/error behavior, and validates adversarial encodings with golden vectors.

    What you get

    Sync encoding logic between client-side signers and backend routers.Prevent signature bypasses from untrusted forwarded host headers.Fix reordering issues with duplicate query string keys in signatures.Standardize Unicode and percent-encoding handling across proxies.

    About this skill

    The problem

    Signed URL verification often fails because signers and verifiers canonicalize request targets differently. Discrepancies in path encoding, query key ordering, or proxy headers lead to intermittent 403 errors or security bypasses.

    What it does

    • Identifies mismatches between signer and verifier canonicalization logic across the repository.
    • Standardizes handling of percent-encoding, Unicode variants, and duplicate query keys.
    • Hardens proxy trust gates by ensuring verification uses preserved request targets rather than reconstructed inputs.
    • Generates byte-stable golden vectors and adversarial local fixtures for regression testing.
    • Implements redacted observability to track verification failures without leaking sensitive tokens.

    Frameworks & tools

    Works with any web framework or proxy configuration including Nginx, AWS CloudFront, Express, Go, and Python. Uses Read, Edit, and Bash tools for repository-level repairs.

    Why this beats prompting it yourself

    General LLMs often suggest simple encoding fixes that break in production behind proxies. This skill enforces a strict resource register and canonical contract, ensuring that normalization logic is consistent across the entire request lifecycle.

    Use cases

    • Resolving 403 Forbidden errors caused by URL re-encoding in middleware.
    • Securing webhook endpoints against host-header injection and request smuggling.
    • Standardizing signature verification for APIs supporting complex query parameters.
    • Debugging inconsistent verification between local development and staging environments.

    Known limitations

    Requires local repository access to signer and verifier source code. Cannot mutate live production infrastructure or rotate actual secrets.

    How to install

    Drop the file into your AI Agent. Works with Claude, Cursor, ChatGPT, and 20+ more.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean today

    • One-time purchase, yours forever

    Listedtoday

    Frequently Asked Questions