Box API File Download Failing on Arbitrary Files

Question

I'm struggling to debug an issue I'm currently having with the Box-API. Given a few thousand of a users files I am able to consistently successfully download most of the files, but other files are consistently failing with the following response:

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidArgument</Code><Message>Either the Signature query string parameter or the Authorization header should be specified, not both</Message><ArgumentValue>BoxAuth api_key=<removed>&amp;auth_token=<removed></ArgumentValue><ArgumentName>Authorization</ArgumentName><RequestId>83572B6EE6CCAF05</RequestId><HostId>MDk4PiUtdr/RS4vqd7p5Qw1MwohBHkhs35dLf6KWZx+11VBQtbTurwq0wVF9QTPC</HostId></Error>

This is being returned from the location of the 302 redirect returned by the https://api.box.com/2.0/files/$ID/content endpoint. For most files this works correctly, but for some reason for certain files it consistently does not. I've captured the headers of the request to the redirect url in both a passing and failing case and can't see any difference:

Passing Case:

GET /bc/1/91652da319a59980c374f9059718080e/JolueqOGpciD6dgYhecNBoVpYxkvmYe1ZLheZor6BF4DUBIelMQTkFwYIys3nIibNIIEHUp447tBZLaXDzIbNQ,,/98713569dfe691813e006a1651c7c3e6/ HTTP/1.1
Host: dl.boxcloud.com
Accept: */*
Authorization: BoxAuth     api_key=<removed>&auth_token=<removed>

Failing Case:

GET /bc/1/44d67f0a3e406676711cbd18cc657696/JolueqOGpciD6dgYhecNBoVpYxkvmYe1ZLheZor6BF4DUBIelMQTkFwYIys3nIibNIIEHUp447tBZLaXDzIbNQ,,/405f32a3d6d6e1240832ab14a08e6d99/ HTTP/1.1
Host: dl.boxcloud.com
Accept: */*
Authorization: BoxAuth     api_key=<removed>&auth_token=<removed>

I'm hitting a wall in terms of debug ideas, so I'm open to suggestions.

score 0 · Accepted Answer · answered Nov 08 '12 at 20:34

It turns out this is an issue with how Curl maintains headers across redirects, coupled with an intolerance of the redirect url at dl.boxcloud.com to box's authorization header. I fixed the problem by setting curl's FOLLOWLOCATION to false, and instead manually following the redirects after clearing all the headers on my request.

It is not yet clear why this only occurred on certain requests, and not others. It is also still not clear to me why the backend would be so sensitive to this behaviour.

Box API File Download Failing on Arbitrary Files

1 Answers1