MediaRequestProtection: An invalid/missing hash value was encountered

Question

My Sitecore error logs contain messages such as:

ERROR MediaRequestProtection: An invalid/missing hash value was encountered. The expected hash value...

What would be causing this? This is only for Sitecore 8 and newer.

Does it have anything to do with the Media.RequestProtection.SharedSecret configuration setting?

Answer 1

It usually means that a Url for a media asset is missing the Hash query string parameter when being called.

This was introduced in v7.5. It attempts to fix an image resize vunerability where you could potentially fill a disk with different image sizes.

If you use a FieldRenderer you will get a valid url with the Hash query string appended.

If you just generate the url, you will need to add the hash. Fortunately Sitecore has some utilities to do that:

Sitecore.Resources.Media.HashingUtils.ProtectAssetUrl : will return the full Url with the hash added.

Use:

Sitecore.Resources.Media.HashingUtils.ProtectAssetUrl(
    Sitecore.Resources.Media.MediaManager.GetMediaUrl(
                           myMediaItem,
                           new MediaUrlOptions()
                           {
                               Language = Context.Language,
                               Width = 100,
                               Height = 75
                           }));

Answer 2

Yes. Likely your solution is not generating protected Media Urls. Used to be:

var mediaUrl = Sitecore.Resources.Media.MediaManager.GetMediaUrl(mediaItem)

Was enough. But to protect against XSS attacks, these should now be protected. Like this:

mediaUrl = Sitecore.Resources.Media.HashingUtils.ProtectAssetUrl(mediaUrl)

Which should make the log warnings go away.

Answer 3

I did some digging:

Sitecore has a mechanism to ensure the validity of dynamically scaled media requests. Read more about this here: https://doc.sitecore.net/sitecore_experience_platform/setting_up__maintaining/security_hardening/configuring/protect_media_request

One should use Sitecore controls (sc:image) for rendering media or use a pattern of Sitecore.Resources.Media.HashingUtils.ProtectAssetUrl(theMediaUrl) instead of just the MediaManager.GetMediaUrl method for rendering media links. This is a likely cause of this exception.

Additionally, Sitecore recommends one change the Media.RequestProtection.SharedSecret setting in the App_Config/Include/Sitecore.Media.RequestProtection.config file. This provides a unique key to you, instead of using the OOTB value in the Sitecore installation. Use the same key for all the Sitecore servers in the solution! We accomplish this via patch .config as follows:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
    <settings>
      <setting name="Media.RequestProtection.SharedSecret">
        <patch:attribute name="value">911edb71-aab3-4a1a-aba1-7ef61de116f</patch:attribute>
      </setting>
    </settings>
  </sitecore>
  </configuration>

Generate a new guid per customer installation, ensuring a unique secret value is in place.

Answer 4

Additionally, you have to check the Sitecore.Media.RequestProtection.config file to ensure you add your custom query string parameter into the protectedMediaQueryParameters list if you have any.

<!--  PROTECTED MEDIA QUERY PARAMETERS
      Specifies a list of parameters that are used to calculate hash values for media requests. 
      The list of parameters is used when the module calculates hash values and appends them to the query strings of the generated
          media URLs, and when the hash values are calculated for incoming media requests and compared to the expected hash values.
      You should add any custom image scaling parameters to this setting if these parameters affect the dimensions or file size of
          dynamically resized images.
-->
<protectedMediaQueryParameters>
  <parameter description="XYZ is my custom parameter" name="xyz"/>
  ...
</protectedMediaQueryParameters>

Also, if you have a specific site, which media URLs you don't want to be protected, you can add it into the ignoreSites list.

<!--  IGNORE SITES
      Specifies a list of site names for which the media protection module should not sign image ULRs with a hash value. When
      Sitecore processes an incoming media request for these sites, it does not check if there is a valid hash value.
-->
<ignoreSites>
  <site name="my-xyz-site"/>
  ...
</ignoreSites>