Invalid media library parameters specified due to query param sorting

Problem/Motivation

CDNs like CloudFlare will sort query parameters to improve cache hit rates. Further reading:

• https://support.cloudflare.com/hc/en-us/articles/206776797-What-is-Query-String-Sort-Enterprise-only-
• https://blog.cloudflare.com/increasing-cache-hit-rates-with-query-string-sort/

#3038241: Implement a tamper-proof hash for the media library state implemented a check to make sure query parameters are not tampered with. However, it does not sort before doing the hash. Thus, when Drupal is behind a CDN with query param sorting it will return HTTP 403 Forbidden:

Request looks like:

POST https://example.com/media-library?media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bimage%5D=image&....redacted....&media_library_content=1

Response looks like:

403 Forbidden

{"message":"Invalid media library parameters specified."}

Proposed resolution

TBD

Remaining tasks

TBD

User interface changes

TBD

API changes

TBD

Data model changes

TBD

Release notes snippet

TBD