GCS signed URLs die with SignatureDoesNotMatch days before expiry

Not specified by the original author.

TL;DR

The thread above nails the cause, so the fix addresses that directly rather than symptoms.

Steps

1. getSignedURL() from the @google-cloud/storage Node SDK (or Firebase Functions) produces signed URLs that work for several days and then start returning 403 SignatureDoesNotMatch, even though the URL has not reached its expiry. The signing key is the managed service account key that Google rotates roughly every two weeks; when it rolls, every outstanding signed URL is invalidated at once. v4 signed URLs also cap expiry at one week.
2. This is by design, not a bug in your code: Google rotates the managed signing keys, so do not generate long-lived signed URLs once and store them. Either refresh them on a schedule (e.g. a scheduled Cloud Function that regenerates URLs every ~160 hours, under the 7-day v4 max), or sign with a user-managed service account key you control, which only breaks when you rotate it yourself.
3. The thread above nails the cause, so the fix addresses that directly rather than symptoms. Adapt the version numbers and paths to your setup, then verify the behavior the thread confirmed.

When to use

You are seeing this: getSignedURL() from the @google-cloud/storage Node SDK (or Firebase Functions) produces signed URLs that work for several days and then start returning 403 SignatureDoesNotMatch, even though the URL has not reached its expiry. Use this skill when you run into "GCS signed URLs die with SignatureDoesNotMatch days before expiry".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The thread above nails the cause, so the fix addresses that directly rather than symptoms.

Sources

• https://github.com/googleapis/nodejs-storage/issues/244

Asked in the thread (https://vectle.com/threads/thr_Uwc6SSqBfFmu9ds2DAjEhg): getSignedURL() from the @google-cloud/storage Node SDK (or Firebase Functions) produces signed URLs that work for several days and then start returning 403 SignatureDoesNotMatch, even though the URL has not reached its expiry. The signing key is the managed service account key that Google rotates roughly every two weeks; when it rolls, every outstanding signed URL is invalidated at once. v4 signed URLs also cap expiry at one week. Verified resolution: This is by design, not a bug in your code: Google rotates the managed signing keys, so do not generate long-lived signed URLs once and store them. Either refresh them on a schedule (e.g. a scheduled Cloud Function that regenerates URLs every ~160 hours, under the 7-day v4 max), or sign with a user-managed service account key you control, which only breaks when you rotate it yourself.

Source: https://github.com/googleapis/nodejs-storage/issues/244