willnorris/imageproxy
Imageproxy
Imageproxy este un server proxy de imagini bazat pe Go care preia, redimensionează și stochează în cache imagini la distanță. Funcționează ca un gateway securizat pentru livrarea activelor de imagine externe, oferind redimensionare și transformare dinamică a imaginilor prin parametri URL.
Serverul implementează controale de securitate pentru a preveni abuzul de proxy și hotlinking-ul neautorizat. Acestea includ verificarea semnăturii cererii folosind HMAC, filtrarea surselor bazată pe liste permise (allow-list) pentru gazde la distanță și restricții de referrer. De asemenea, utilizează filtrarea conținutului de tip MIME pentru a se asigura că sunt procesate doar formatele de fișiere suportate.
Proiectul include un strat de caching pentru a stoca imaginile procesate în memorie, pe disc local sau prin furnizori de stocare în cloud. Suportă transformări dinamice ale imaginilor, inclusiv ajustarea dimensiunilor, decuparea, rotirea și inversarea activelor din mers.
Features
- Programmatic Resizing and Cropping - Provides programmatic image resizing and cropping through a proxy layer using API-driven parameters.
- On-the-Fly Transformations - Performs image resizing and cropping in memory during the request-response cycle.
- Image Proxy Caches - Caches processed versions of remote images locally to reduce bandwidth and improve page load speeds.
- URL-Driven Image Transformations - Adjusts image dimensions, crops, rotates, and flips assets dynamically via parameters in the request URL.
- Image Processing Servers - Operates as an HTTP server that fetches, resizes, and caches remote images via URL parameters.
- Request Signature Verification - Verifies the integrity and authenticity of requests using cryptographic signatures to prevent unauthorized proxy usage.
- Secure Image Delivery - Protects image processing services from abuse using signed URLs and domain restrictions.
- Domain Allow-Lists - Implements security controls that validate remote hosts against a trusted list before fetching images.
- Request Signing - Uses HMAC-based cryptographic signatures in URLs to verify the authenticity of transformation requests.
- Remote Source Restrictions - Limits external hosts the proxy can fetch images from using allow-lists and deny-lists.
- Asset Proxy Security - Prevents unauthorized access and hotlinking using request signing and referrer restrictions.
- Transformation Parameters - Parses request path parameters to determine the specific scaling, cropping, and rotation operations to apply.
- Image Caches - Implements a caching layer for image data with configurable storage backends to reduce latency.
- Processed Image Caching - Stores generated image variants in memory, on disk, or in the cloud to avoid redundant processing.
- Content-Type Filtering - Inspects response headers to ensure only supported image MIME types are processed by the proxy.
- Referrer-Based Access Control - Blocks requests not originating from a list of trusted HTTP referrers to prevent unauthorized hotlinking.
- Dynamic Asset Delivery - Optimizes the delivery of processed images through a secure gateway and caching layer for faster response times.
- Pluggable Cache Backends - Provides a pluggable interface for caching processed images in memory, on disk, or in cloud storage.
