I did some digging:

Sitecore has a mechanism to ensure the validity of dynamically scaled media requests. Read more about this here: https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening/configuring/protect_media_request

One should use Sitecore controls (sc:image) for rendering media or use a pattern of Sitecore.Resources.Media.HashingUtils.ProtectAssetUrl(theMediaUrl) instead of just the MediaManager.GetMediaUrl method for rendering media links. This is a likely cause of this exception.

Additionally, Sitecore recommends one change the Media.RequestProtection.SharedSecret setting in the App_Config/Include/Sitecore.Media.RequestProtection.config file. This provides a unique key to you, instead of using the OOTB value in the Sitecore installation. Use the same key for all the Sitecore servers in the solution! We accomplish this via patch .config as follows:

Generate a new guid per customer installation, ensuring a unique secret value is in place.

I did some digging:

Sitecore has a mechanism to ensure the validity of dynamically scaled media requests. Read more about this here: https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening/configuring/protect_media_request

One should use Sitecore controls (sc:image) for rendering media or use a pattern of Sitecore.Resources.Media.HashingUtils.ProtectAssetUrl(theMediaUrl) instead of just the MediaManager.GetMediaUrl method for rendering media links. This is a likely cause of this exception.

Additionally, Sitecore recommends one change the Media.RequestProtection.SharedSecret setting in the App_Config/Include/Sitecore.Media.RequestProtection.config file. This provides a unique key to you, instead of using the OOTB value in the Sitecore installation. Use the same key for all the Sitecore servers in the solution! We accomplish this via patch .config as follows:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
    <settings>
      <setting name="Media.RequestProtection.SharedSecret">
        <patch:attribute name="value">911edb71-aab3-4a1a-aba1-7ef61de116f</patch:attribute>
      </setting>
    </settings>
  </sitecore>
  </configuration>

Generate a new guid per customer installation, ensuring a unique secret value is in place.