Skip to content

Forward metadata param on signed uploads in Util.buildUploadParams#387

Open
sebastienmartin-bm wants to merge 1 commit into
cloudinary:masterfrom
sebastienmartin-bm:fix/signed-upload-metadata-passthrough
Open

Forward metadata param on signed uploads in Util.buildUploadParams#387
sebastienmartin-bm wants to merge 1 commit into
cloudinary:masterfrom
sebastienmartin-bm:fix/signed-upload-metadata-passthrough

Conversation

@sebastienmartin-bm

@sebastienmartin-bm sebastienmartin-bm commented Jun 30, 2026

Copy link
Copy Markdown

🔍 Brief Summary of Changes

Hello there @const-cloudinary, it seems you are the person in charge taking care of the repository 💪
Here is a little PR that hopefully solves and explain an issue we encountered lately with @vschoener

When an upload request carries a server-computed signature, Util.buildUploadParams takes a "pre-signed" branch that forwards only a fixed allow-list of write params.

🐛 Our issue: metadata is not on the "allow-list" list, so it is silently dropped and never sent to Cloudinary that re-compute the signature against our backend:

401 Invalid Signature ... String to sign - 'asset_folder=...&timestamp=...&upload_preset=...'

(Note metadata is absent from the string Cloudinary reconstructs.)

Root cause

In cloudinary-core/.../com/cloudinary/Util.java, buildUploadParams only copies metadata via processWriteParameters, which is only called if there are no signatures.

The else (signature-present) branch forwards eager, transformation, headers, tags, face_coordinates, context, ocr, raw_convert, categorization, detection, similarity_search, auto_tagging, access_control - but not metadata.

Fix

Add metadata to the pre-signed pass-through branch, mirroring how context is already handled there (the value is already serialized, so it's passed through as-is).

📑 Note on SDK parity w/ 🍎

The iOS SDK does not filter params on the signed path (CLDNetworkCoordinator.getSignedRequestParams forwards the full param set), so a presigned upload including metadata already works on iOS.

This change brings the Java/Android SDK in line (at least for the metadata).

ℹ️ With this changes we were able to fix our upload issue by making cloudinary-android-core a local patched module of cloudinary-core.

Many thanks for your time reviewing the PR 🙏

What does this PR address?

  • GitHub issue
  • Refactoring
  • New feature
  • Bug fix
  • Adds more tests

Are tests included?

  • Yes
  • No

✅ Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I ran the full test suite before pushing the changes and all the tests pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant