willnorris/imageproxy
Imageproxy
Imageproxy is a Go-based image proxy server that fetches, resizes, and caches remote images. It functions as a secure gateway for delivering external image assets, providing dynamic image resizing and transformation via URL parameters.
The server implements security controls to prevent proxy abuse and unauthorized hotlinking. These include request signature verification using HMAC, allow-list based source filtering for remote hosts, and referrer restrictions. It also utilizes MIME-type content filtering to ensure only supported file formats are processed.
The project includes a caching layer to store processed images in memory, on local disk, or via cloud storage providers. It supports dynamic image transformations, including adjusting dimensions, cropping, rotating, and flipping assets on the fly.
Features
- Programmatic Resizing and Cropping - Provides programmatic image resizing and cropping through a proxy layer using API-driven parameters.
- On-the-Fly Transformations - Performs image resizing and cropping in memory during the request-response cycle.
- Image Proxy Caches - Caches processed versions of remote images locally to reduce bandwidth and improve page load speeds.
- URL-Driven Image Transformations - Adjusts image dimensions, crops, rotates, and flips assets dynamically via parameters in the request URL.
- Image Processing Servers - Operates as an HTTP server that fetches, resizes, and caches remote images via URL parameters.
- Request Signature Verification - Verifies the integrity and authenticity of requests using cryptographic signatures to prevent unauthorized proxy usage.
- Secure Image Delivery - Protects image processing services from abuse using signed URLs and domain restrictions.
- Domain Allow-Lists - Implements security controls that validate remote hosts against a trusted list before fetching images.
- Request Signing - Uses HMAC-based cryptographic signatures in URLs to verify the authenticity of transformation requests.
- Remote Source Restrictions - Limits external hosts the proxy can fetch images from using allow-lists and deny-lists.
- Asset Proxy Security - Prevents unauthorized access and hotlinking using request signing and referrer restrictions.
- Transformation Parameters - Parses request path parameters to determine the specific scaling, cropping, and rotation operations to apply.
- Image Caches - Implements a caching layer for image data with configurable storage backends to reduce latency.
- Processed Image Caching - Stores generated image variants in memory, on disk, or in the cloud to avoid redundant processing.
- Content-Type Filtering - Inspects response headers to ensure only supported image MIME types are processed by the proxy.
- Referrer-Based Access Control - Blocks requests not originating from a list of trusted HTTP referrers to prevent unauthorized hotlinking.
- Dynamic Asset Delivery - Optimizes the delivery of processed images through a secure gateway and caching layer for faster response times.
- Pluggable Cache Backends - Provides a pluggable interface for caching processed images in memory, on disk, or in cloud storage.
