nonce_used error when getting image information

[MichelleCox]

Hello,

I am using the library to connect my club's Drupal website to Smugmug. I have it working for uploading images and for getting the image count of a gallery. I seem to be stuck on viewing an image, though.

When I try to access an image via its key, I get:

Client error: GET https://api.smugmug.com/api/v2/image/WprRLwK?_verbosity=1 resulted in a 401 Unauthorized response:
{"Code":401,"Message":"oauth_problem=nonce_used"}

It's a public image so you can put that URL into a browser and see that it exists and retrieves the information just fine without oauth. I don't know a lot about oauth. From what little I could get out of Google, it sounds like some token is being sent more than once? But the tokens always stay the same so what I'm finding isn't making any sense to me.

$this->client->get("/api/v2/album/$key"); works but $this->client->get("/api/v2/image/$key"); gets me the nonce_used error.

I'd appreciate any help. I tried posting in the Smugmug forum but haven't gotten any response. Hoping you can help me as I'm totally stuck at this point.

Thanks,

Michelle

[lildude]

🤔 I wonder if this is due to a problem with the clock on your system. I say this because the nonce should always be unique as it's a SHA1 hash generated using uniqid and the URL here. The only part that will change is the unique ID which is based on the time and as per the warning on the uniqid manual page, there's a chance it may not be unique if your system time changes.

Are you able to share your code or point me to the repo so I can see if I can spot any issues or reproduce it? If not, are you able to reproduce the issue using the example-oauth.php file in this repo?

[MichelleCox]

I've only tried it on my local environment. I could try setting up a test on prod to see if that makes any difference. The repo is private so I'd need your email address to add you, but here is the source of my service that handles all the interaction with the library:

SmugmugService.php.txt

These functions are working fine:
getImageCount
uploadFromPath
uploadFromUri

This one is the one that gives me the nonce error:
getImage

These aren't finished/tested because I first need the image object so I need getImage working:
updateImageValues
deleteImage

Thanks!

[lildude]

Thanks. I've managed to reproduce the issue and work out why it's happening.

When you make the request to get the image without specifying the serial number (ie the -0 at the end) the API 301 redirects you to the latest and it's this redirection that is causing the same nonce to be reused as the new request doesn't generate a new signature.

You can see this in the your browser when opening https://api.smugmug.com/api/v2/image/WprRLwK; it'll automatically redirect you to https://api.smugmug.com/api/v2/image/WprRLwK-0 - note the extra -0 on the end.

I'm not sure how to best handle this redirect off the top of my head, but from a performance perspective you probably don't want this redirect anyway.

As a possible workaround, if you're getting the key from another query where you've queried the album, you could use the Uri field instead of the ImageKey.

[MichelleCox]

Ah, I had no idea the key would change. I'm storing the key in the Drupal entity as a reference to the image. This allows Drupal to make changes/delete it as needed. If I can get the Uri field in the response when the image is uploaded, I'll save that instead of the key. Thanks for figuring this out! Hopefully the URI option will work for me.

[lildude]

This should now be fixed thanks to #73.