Troubleshooting the error "MediaRequestProtection: An invalid/missing hash value was encountered"


Description

The Media Request Protection feature has been introduced in Sitecore XP 7.5 to restrict media URLs that contain dynamic image-scaling parameters, so that only server-generated requests are processed. This ensures that the server only spends resources and disk space on valid image scaling requests.

This article provides different scenarios for troubleshooting the error MediaRequestProtection: An invalid/missing hash value was encountered:

The following message can be found in the logs:

ERROR MediaRequestProtection: An invalid/missing hash value was encountered.
The expected hash value: 7D6A9AD7AB99A899D3DB57CDA568256C.
Media URL: /-/media/images/logo.ashx?h=200&w=200,
Referring URL: https://example.com

An invalid/missing hash value is treated as an error because Sitecore cannot verify the legitimacy of the request. As a result, Sitecore returns a response using default parameters, preventing the system from being overloaded by unverified requests.

Scenario 1 – Media URL includes a hash parameter that does not match the expected hash value

To troubleshoot the issue, take these steps:

  1. Ensure all Sitecore instances in the environment use the same value for:
    • The Media.RequestProtection.SharedSecret setting.
    • The Media.RequestProtection.HashParameterName setting.
    • The list of protectedMediaQueryParameters.
  2. Ensure that the media URL is not manipulated after the hash parameter has been assigned.

Scenario 2 – Media URL does not have a hash parameter (when not using Headless Rendering)

To troubleshoot the issue, take these steps:

  1. Make sure to call HashingUtils.ProtectAssetUrl(url) when rendering URLs using custom code.
  2. If the <renderField> pipeline has been customized, make sure that the customization does not prevent the execution of the Sitecore.Pipelines.RenderField.ProtectedImageLinkRenderer processor, or the customization uses similar logic to replace the default processor.

Scenario 3 – Media URL does not have a hash parameter (for Headless Rendering)

When using Sitecore Headless Rendering, namely in a JSS application, the error message contains the jssmedia handler. For example:

Media URL: /-/jssmedia/images/logo.ashx?h=200&w=200

To troubleshoot the issue, verify whether the requested image size is explicitly allowed in the application configuration. See the example here.