TYPO3 Core

The issue is that the "context" data (over which the hmac is computed) is sent to the browser as a JSON object, which the browser then encodes again using JSON.stringify() when making an AJAX call. However, JavaScript's JSON.stringify does not guarantee to return the same string as PHP's json_encode, e.g. because JSON objects do not have a defined order[0].
The fix is to pass the "context" as a string and not as a JSON object. I've created and attached a patch based on TYPO3 9.5.7 which implements this which fixes this issue in my tests. (I cannot log in to review.typo3.org, so I can't create a change in Gerrit.)

I had this issue with the Gridelements extension, which had a "columns" key (so alphabetic and not numeric) in the "overrideChildTca" object when adding an image to a Gridelements content element.
TYPO3 generated this context JSON (beautified for better readability):

{
    "type": "inline",
...
    "overrideChildTca": {
        "0": {
            "showitem": "--palette--;LLL:EXT:lang\/locallang_tca.xlf:sys_file_reference.imageoverlayPalette;imageoverlayPalette, --palette--;;filePalette" 
        },
...
        "columns": {
            "uid_local": {
                "config": {
                    "appearance": {
                        "elementBrowserType": "file",
                        "elementBrowserAllowed": "" 
                    }
                }
            }
        },
    },
...
}

However the JavaScript used the following in its AJAX call in Chromium (via JSON.stringify):

{
    "type": "inline",
...
    "overrideChildTca": {
        "columns": {
            "uid_local": {
                "config": {
                    "appearance": {
                        "elementBrowserType": "file",
                        "elementBrowserAllowed": "" 
                    }
                }
            }
        },
        "0": {
            "showitem": "--palette--;LLL:EXT:lang\/locallang_tca.xlf:sys_file_reference.imageoverlayPalette;imageoverlayPalette, --palette--;;filePalette" 
        },
...
    },
...
}

Note that even if all keys were numeric, one cannot rely on JSON.stringify to order the object keys numerically. That's why in my patch I just pass around the context as a string.

[0]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify "Properties of non-array objects are not guaranteed to be stringified in any particular order. Do not rely on ordering of properties within the same object within the stringification."

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/61042

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63808

Applied in changeset 0f1281410f62bdf94c78736ea4e41ca2618fab44.