This private-user-images.githubusercontent.com page can’t be found

[jsoref]

GitHub Mobile beta for Android

1. Visit Terminal error message: Access denied microsoft/winget-cli#4178 (comment)
2. Click one of the pictures (it's to small to view in the app)

Actual results
https://private-user-images.githubusercontent.com/57057288/305601864-adcfb6cc-1c25-408e-b698-c8e2fc68fa27.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDgyODg3NDcsIm5iZiI6MTcwODI4ODQ0NywicGF0aCI6Ii81NzA1NzI4OC8zMDU2MDE4NjQtYWRjZmI2Y2MtMWMyNS00MDhlLWI2OTgtYzhlMmZjNjhmYTI3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDAyMTglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwMjE4VDIwMzQwN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPThlYWI5NjYzNjMzZWZiMTJmYTU1ZDEzNmI4MGRkNmRiMGVhMmMxYjI1ZjY4OTM1ZmJiMTkxOTJlMzE0ZmQzNTgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.AquZusvFJuXEwgX-e_ii3Vx1_cRze47aGrla5sKjQrk

This private-user-images.githubusercontent.com page can’t be found
No webpage was found for the web address: https://private-user-images.githubusercontent.com/57057288/305601864-adcfb6cc-1c25-408e-b698-c8e2fc68fa27.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDgyODg3NDcsIm5iZiI6MTcwODI4ODQ0NywicGF0aCI6Ii81NzA1NzI4OC8zMDU2MDE4NjQtYWRjZmI2Y2MtMWMyNS00MDhlLWI2OTgtYzhlMmZjNjhmYTI3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDAyMTglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwMjE4VDIwMzQwN1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPThlYWI5NjYzNjMzZWZiMTJmYTU1ZDEzNmI4MGRkNmRiMGVhMmMxYjI1ZjY4OTM1ZmJiMTkxOTJlMzE0ZmQzNTgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.AquZusvFJuXEwgX-e_ii3Vx1_cRze47aGrla5sKjQrk
HTTP ERROR 404

[iskae]

Hi @jsoref 👋

Thank you for reaching out and taking the time to describe the problem that you have been facing ❤️
Unfortunately, I was not able to reproduce your problem. Are you logged in to GitHub on your browser on mobile by any chance?

[jsoref]

Hmmm. It's working for me now. I was definitely authenticated in Chrome too...

[iskae]

Maybe it was a temporary hiccup in our API 😅 I am glad that it is working for you now though 🙇

[MetRonnie]

Actually one of my colleagues has pointed out that if you decode the JSON web token in the URL, you find an expiry date that is 5 mins in the future from loading the page for the issue/PR/whatever. So this seems to be a conscious design decision

{
  "iss": "github.com",
  "aud": "raw.githubusercontent.com",
  "key": "key5",
  "exp": 1708288747,
  "nbf": 1708288447,
  "path": "/57057288/305601864-adcfb6cc-1c25-408e-b698-c8e2fc68fa27.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240218%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240218T203407Z&X-Amz-Expires=300&X-Amz-Signature=8eab9663633efb12fa55d136b80dd6db0ea2c1b25f68935fbb19192e314fd358&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=0"
}

[jsoref]

So... This ticket is not about the fact that they're using 404 instead of 401 or the related detail that the error message isn't remotely helpful to users.

It's about the fact that clicking a link from a GitHub hosted page (which triggers a path that generates a signed URL thing as a redirect) results in an error. In theory, most people expect this flow to work reliably. In practice, at least one other person managed to reproduce this behavior and take the time to find this issue and comment on it.

[Rudxain]

Does this token allow a privilege scalation attack?

[SomeTroglodyte]

As far as I can tell, images are meant to no longer be clickable, all I get are the comment-column-width limited views. Including my own images in my own PR's, and no matter whether logged in or not. Repeat: all githubusercontent images I can find give that 404 since at least early last year. Probably all part of the gamification going on.

[jsoref]

I can click on the issue listed in the original report and click on an image from it and it loads (in general) in Chrome.

[MetRonnie]

Try reloading the page before clicking the image. As I've mentioned in my comment the images now have a timeout of 5 mins before they can no longer be opened without reloading the page first.

[Rudxain]

This also happens when quote-replying

[jcollum-nutrien]

I'm running into this today. I put some screenshots in a PR and then went on vacation. Here it is a month later after I opened the PR (the team had other priorities while I was gone) and when I clicked one of the images (because I wanted to read it better) I get this This private-user-images.githubusercontent.com page can’t be found message. It's annoying, if the images have a limited lifetime that should be noted somewhere.

edit: reloading the page fixed the problem. That's definitely a violation of PLA.

[trevorsandy]

I am facing this behaviour right now 10/10/2024@17:30 CET. Moreover, it's happening to an image I uploaded in response to one of my fixed tickets.

It does not seem right that I had to google this ticket and come here to get some idea on what is happening and why. Seems like a better job can be done in the click-response to better inform users. As said above - certainly a violation of PLA.

Update: reloading the page fixed the unexpected behavior for me.

Cheers,

[HighAley]

I think everyone gets the issue. I have found out how to reproduce it. Just open any page with an image and wait for 5 minutes until tolen expires. Then clicking on any image returns this error.