Expired Signatures

[Kerrick]

📚 Summary

The RFC introduces a new method to RequestContract that will allow developers to check if a signed URL used to be valid, but has expired.

🔗 Links

Full Rendered Proposal
Original PR

[thetutlage]

Hello 👋

Thanks for your proposal.

I think in both the cases showing a generic error page should be the way to go. Leaking too specific information about SignedURL or tokens is usually considered bad practice, because it can lead to brute force attacks.

I do not have any specific document that talks about SignedURLs security. But, a general read around "Brute force password reset token" will give you answer why tokens invalidity reason should be kept opaque.