title: Problems with security policy for Filepicker Convert?
body: <p>I use Filepicker to "read" then "store" an image from clients' computer. Now I want to resize the image using Filepicker but always get a 403 error:</p>
  
  <pre><code>POST https://www.filepicker.io/api/file/w11b6aScR1WRXKFbcXON/convert?_cacheBust=1380818787693 403 (FORBIDDEN) 
  </code></pre>
  
  <p>I am using the same security policy and signature for the "read", "store", and "convert" calls. Is this wrong? Because when "read" and "store" are called there is no file handle yet (e.g. the last string part in InkBlob.url). But it seems the "convert" policy/signature must be generated using the file handle returned with the "store" InkBlob? And if this is the case, what's a more convenient way to do in javascript? Because in "convert" I have no access to the Python function that generates security policies unless I write an API call for that.</p>
  
  <p>My code snippet as below (initialFpSecurityObj was pre-generated in Python using an empty handle):</p>
  
  <pre><code>filepicker.store(thumbFile, {
      policy: initialFpSecurityObj.policy, 
      signature: initialFpSecurityObj.signature,
      location: "S3",
      path: 'thumbs/' + initialFpSecurityObj.uniqueName + '/',
  },function(InkBlob){
      console.log("Store successful:", JSON.stringify(InkBlob));
      processThumb(InkBlob);
  }, function(FPError){
      console.error(FPError.toString());
  });
  
  var processThumb = function(InkBlob){
      filepicker.convert(InkBlob, {
          width: 800,
          height: 600,
          format: "jpg",
          policy: initialFpSecurityObj.policy, 
          signature: initialFpSecurityObj.signature,
      }, function(InkBlob){
          console.log("thumbnail converted and stored at:", InkBlob);
      }, function(FPError){
          console.error(FPError);
      };
  }
  </code></pre>
  
  <p>Thanks a lot for the help.</p>
  
  <p>--- EDIT ---</p>
  
  <p>Below is the snippet for the Python code that generates initialFpSecurityObj</p>
  
  <pre><code>def generateFpSecurityOptions(handle, userId, policyLife=DEFAULT_POLICY_LIFE):
      expiry = int(time() + policyLife)
      json_policy = json.dumps({'handle': handle, 'expiry': expiry})
      policy = base64.urlsafe_b64encode(json_policy)
  
      secret = 'XXXXXXXXXXXXXX'
      signature = hmac.new(secret, policy, hashlib.sha256).hexdigest()
  
      uniqueName = hashlib.md5()
      uniqueName.update(signature + repr(time()))
      uniqueName = uniqueName.hexdigest() + str(userId)
  
      return {'policy':policy, 'signature':signature, 'expiry':expiry, 'uniqueName':uniqueName}
  
  fp_security_options = generateFpSecurityOptions(None, request.user.id)
  </code></pre>
  
  <p>Then in the django template fp_security_options is retrieved:</p>
  
  <pre><code>var initialFpSecurityObj = {{fp_security_options|as_json|safe}};
  </code></pre>
  
  <p>The way that generates fp_security_options is suspicious to me (former colleague's code) because the handle is None.</p>