willnorris/imageproxy
Imageproxy
Imageproxy ist ein Go-basierter Image-Proxy-Server, der Remote-Bilder abruft, in der Größe anpasst und zwischenspeichert. Er fungiert als sicheres Gateway für die Bereitstellung externer Bild-Assets und bietet dynamische Bildgrößenanpassung und Transformation über URL-Parameter.
Der Server implementiert Sicherheitskontrollen, um Proxy-Missbrauch und unbefugtes Hotlinking zu verhindern. Dazu gehören die Überprüfung von Request-Signaturen mittels HMAC, eine Allow-List-basierte Quellfilterung für Remote-Hosts und Referrer-Beschränkungen. Er nutzt zudem MIME-Typ-Inhaltsfilterung, um sicherzustellen, dass nur unterstützte Dateiformate verarbeitet werden.
Das Projekt enthält eine Caching-Ebene, um verarbeitete Bilder im Speicher, auf der lokalen Festplatte oder über Cloud-Speicheranbieter zu speichern. Es unterstützt dynamische Bildtransformationen, einschließlich der Anpassung von Abmessungen, Zuschneiden, Drehen und Spiegeln von Assets im laufenden Betrieb.
Features
- Programmatic Resizing and Cropping - Provides programmatic image resizing and cropping through a proxy layer using API-driven parameters.
- On-the-Fly Transformations - Performs image resizing and cropping in memory during the request-response cycle.
- Image Proxy Caches - Caches processed versions of remote images locally to reduce bandwidth and improve page load speeds.
- URL-Driven Image Transformations - Adjusts image dimensions, crops, rotates, and flips assets dynamically via parameters in the request URL.
- Image Processing Servers - Operates as an HTTP server that fetches, resizes, and caches remote images via URL parameters.
- Request Signature Verification - Verifies the integrity and authenticity of requests using cryptographic signatures to prevent unauthorized proxy usage.
- Secure Image Delivery - Protects image processing services from abuse using signed URLs and domain restrictions.
- Domain Allow-Lists - Implements security controls that validate remote hosts against a trusted list before fetching images.
- Request Signing - Uses HMAC-based cryptographic signatures in URLs to verify the authenticity of transformation requests.
- Remote Source Restrictions - Limits external hosts the proxy can fetch images from using allow-lists and deny-lists.
- Asset Proxy Security - Prevents unauthorized access and hotlinking using request signing and referrer restrictions.
- Transformation Parameters - Parses request path parameters to determine the specific scaling, cropping, and rotation operations to apply.
- Image Caches - Implements a caching layer for image data with configurable storage backends to reduce latency.
- Processed Image Caching - Stores generated image variants in memory, on disk, or in the cloud to avoid redundant processing.
- Content-Type Filtering - Inspects response headers to ensure only supported image MIME types are processed by the proxy.
- Referrer-Based Access Control - Blocks requests not originating from a list of trusted HTTP referrers to prevent unauthorized hotlinking.
- Dynamic Asset Delivery - Optimizes the delivery of processed images through a secure gateway and caching layer for faster response times.
- Pluggable Cache Backends - Provides a pluggable interface for caching processed images in memory, on disk, or in cloud storage.
