Livewire WithFileUpload 401 with url's not matching so failing signature check - file-upload

Question

I have a livewire file uploader on a project. When you select a file it says The uploads failed to upload. The firefox dev toolbox says it is a 401 error. I investigated further and found via https://github.com/livewire/livewire/issues/1216 that commenting out a line in the livewire vendor src (abort_unless(request()->hasValidSignature(), 401);) actually doesn't show this message and allows the file to upload but this is obviously extremely bad practice for mulitple reasons (update of livewire will undo change, it removes csrf protection and as it's in the vendor folder it is not in my repo).
I decided instead to step into how this is working and found it is creating a malformed url. This is in the laravel framework /Illuminate/Routing/UrlGenerator: line 413 [hasCorrectSignature]
/**
* Determine if the signature from the given request matches the URL.
*
* #param \Illuminate\Http\Request $request
* #param bool $absolute
* #param array $ignoreQuery
* #return bool
*/
public function hasCorrectSignature(Request $request, $absolute = true, array $ignoreQuery = [])
{
$ignoreQuery[] = 'signature';
$url = $absolute ? $request->url() : '/'.$request->path();
$queryString = collect(explode('&', (string) $request->server->get('QUERY_STRING')))
->reject(fn ($parameter) => in_array(Str::before($parameter, '='), $ignoreQuery))
->join('&');
$original = rtrim($url.'?'.$queryString, '?');
$signature = hash_hmac('sha256', $original, call_user_func($this->keyResolver));
return hash_equals($signature, (string) $request->query('signature', ''));
}
As I step over this function with Xdebug I get the following variables
$url = "https://my-project.dev/livewire/upload-file"
$queryString = "/livewire/upload-file&expires=1674038186"
$original = "https://my-project.dev/livewire/upload-file?/livewire/upload-file&expires=1674038186" <- note this is malformed right?
signature this makes is
fc95677fc265d9ad90e0ff5413eecf5cb08df82b3971b468109e1011fc323406
And lastly the signature created from the query is
6152b1a0c51c2e7532d2665bf3f2cf3a809802689185b0c5d73e2854024de124
So these do not match and thus it fails, I suspect that the signature of the correct url will match the 2nd signature (i.e. signature for https://my-project.dev/livewire/upload-file&expires=1674038186). So how do I ensure this url is correct.
I've noticed a more than likely related issue with url's when I login the app after being auto logged out so if i was on a page https://my-project.dev/foo/bar then after logging back in it is now https://my-project.dev/foo/bar?%2Ffoo%2Fbar= This has no impact on the page that is generated.
My .htaccess in the public folder is:
Options -Indexes
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php?/$1 [L,QSA]
thanks

Answer 1

For anyone else that has this issue I had an overnight epithany and realised that the issue is the wildcard in the htaccess RewriteRule. Remove the ? and everything works correctly. It also fixed the odd url issue I was getting.
Options -Indexes
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L,QSA]