Sprite url normalization breaks some url encoding / signing schemes

[jcary741]

maplibre-gl-js version: 5.0.0-pre.4 / main

browser: Chrome

Expected Behavior

I'm using Amazon Location Service-hosted maps, which require url signing (AWS Signature Version 4) for all requests. Upon transformRequest, they expect the url not to materially change.

Actual Behavior

Following #3898, normalizeSpriteURL() creates a new URL object to parse the URL, then converts it back to string. Something in this process appears to mangle encoding of the signature, or possibly materially changes the url itself in such a way that it is no longer valid.

Possible solution

Instead of having normalizeSpriteUrl be an automatic, internal step, I suggest having a default version of transformRequest which checks for the 'Sprite' resource type and applies the "normalization" process. However, if the developer sets their own transformRequest, this can be overridden.

Recent changes to MapLibre are looking awesome! Keep up the good work! <3

[HarelM]

Thanks for taking the time to report this issue and try out the latest version!
I'm not sure I fully understand what you are suggesting or what exactly the problem is.
I would advise to open a PR with the relevant test and a possible fix.

[jcary741]

Heh, I actually just noticed your comment here, which is essentially what is going wrong here. Reviewing the several issues / PRs relating to this topic, I can see how nuanced this discussion is. I'll see what I can do about putting together a PR shortly.

[jcary741]

#4962 will resolve this issue, primarily by reverting #3898. One thing I'll mention here in case anyone else is dealing with signed URLs is that, as it turns out, the issue wasn't encoding related as I had thought, instead it was simply that the signature was being generated before ".json" was appended to the sprite URL pathname, thereby invaliding the signature.