I hit a weird error today. My project stores user uploads on S3 with
private permissions, and we use the Paperclip
expiring_url method to let people download them. This started failing with a error like this:
<Error> <Code>AccessDenied</Code> <Message>Request has expired</Message> <Expires>2015-04-28T18:30:51Z</Expires> <ServerTime>2015-04-28T18:32:52Z</ServerTime> <RequestId>BLAHBLAHBLAHBLAH</RequestId> <HostId> MOREBLAHMOREBLAHMOREBLAHMOREBLAHMOREBLAHMOREBLAHMOREBLAH </HostId> </Error>
The problem was that this error occurred immediately, even though we were generating the URLs with a 10 minute expiration time. Well, it turns out S3 was living in the future by 7 minutes (according to
ServerTime above), and our own app was living in the past by another 5. So 5 + 7 = 12 and our URLs were expired before we even generated them. 10 minutes is the example time in the Paperclip documentation linked above, but I guess it’s too short. Watch out for clock skew out there folks!