Auth timestamp as signature expiry?

[eriklott]

I enjoy this little gem. We use it in projects from time to time when we need signed requests. Thanks for maintaining it.

In our current project, we're using the signature gem to secure a simple api. We provide clients with secure urls (signed with signature gem) which they use to view private resources, valid for a certain amount of time. Problem is, some urls should be valid for 1 hour, and some for 1 week. Because the signature expiry (timestamp_grace) is controlled on the receiving end of the request (during authentication), I don't think the gem will work for us in its current state (we'll likely tweak it).

Have you considered using your auth_timestamp param as the signature expiry, rather than a simple timestamp?

[mmzoo]

Can you not just send in an additional parameter to indicate when the URL should be considered expired?