[lazerg]

This pull request fixes an issue where signed Glide URLs return 400 Signature is not valid. when the site's url is on a different domain from the one serving Statamic, like a headless setup where the site points at the frontend.

GlideController::validateSignature() gets the path to check by stripping the current site's absolute URL off the request URL. When the site URL isn't a prefix of the request URL, Str::after() returns the full URL, which never matches the signature generated over /img/....

This PR fixes it by falling back to the request path when the request URL doesn't start with the site URL. Sites with a path prefix like /fr/ still go through the existing branch. The prefix check compares both URLs with a trailing slash, so a site URL like http://localhost no longer matches a request to http://localhost:8000.

Fixes #15506

[lazerg]

@duncanmcclean, please have a look when you have time

[duncanmcclean]

Thanks for this! One case that's still broken: multisite setups where the sites have path prefixes and live on a different domain from the app.

For example:

en:
  url: https://www.example.com/
fr:
  url: https://www.example.com/fr/

A URL generated for the fr site comes out as /fr/img/asset/..., but the signature is generated over /img/asset/.... Requesting it from the app domain:

1. No site matches the request URL, so Site::current() falls back to the default site.
2. We hit the getPathInfo() fallback, which returns /fr/img/asset/....
3. The paths don't match, so it's a 400 Signature is not valid.

Could you strip the matching site's path prefix (e.g. the longest URL::makeRelative($site->url()) that the path starts with) before validating? It would be good to add a test for it too, alongside the ones you've already added.

[lazerg]

Done in d5e3370. If no site matches the request URL, I now strip the longest site path prefix before checking the signature, and I added a test for a /fr/ site on another domain.