403 Forbidden error from cloudfront · Issue #2438 ...
Looking at the log timestamp, we can see that this is just barely timed out -- the log line was recorded ~766ms after the signature expires. So what is possible is that the request was sent just before the expiry time (22:17:03.99, say). If the client did a simple check at that point, the signature would still appear to be valid.
DA: 4 PA: 38 MOZ Rank: 45