On a multi-language site and the generated signature path in the /.well-known/security.txt file contains the current language.
And that path give a 403.
It works well when i remove the language prefix in the signature path.
Ex.
https://my.domain.be/nl/.well-known/security.txt.sig => 403
https://my.domain.be/.well-known/security.txt.sig => OK
During the config of the security.txt module on a multilanguage site within the 'Sign' config form.
Generate URL's without the language-prefix. ( See on line 36 in function 'getSecuritytxtFile' )
But i don't know if that's even possible.
Active
1.2
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
It would be easy enough to strip the path prefix from the URL.
You can get the path prefixes with:
$prefixes = \Drupal::config('language.negotiation')->get('url.prefixes');
So... just loop through these and strip from signature_url if it starts with that + /.
Does someone want to create a patch/MR?
Here is a fix compatible with the latest versions of the module