Troubleshooting

403 on signed URLs

• Check that the full query string is preserved by the proxy ($query_string in Nginx).

• Ensure WEBRICK_SIGN_KEY matches between generator and verifier.

• If using temporary URLs, confirm clock skew and TTL (signedDefaultTtl).

• Verification failures are raised internally as HTTP exceptions and rendered by the kernel error boundary, so custom top-level error rendering still applies.

406 Not Acceptable

• Negotiation middleware rejects unacceptable Accept headers. Ensure your client requests supported types.

• The middleware now throws a framework HTTP exception internally; the kernel error boundary renders the final 406.

• Use Response::auto() for convenience.

Weird caches

• Verify Vary headers include Accept-Encoding/Accept-Language as emitted by middleware.

• Avoid stripping or overwriting Vary at the proxy/CDN.