willnorris/imageproxy
Imageproxy
Imageproxy 是一个基于 Go 的图片代理服务器，用于获取、调整大小并缓存远程图片。它作为一个用于交付外部图片资产的安全网关，通过 URL 参数提供动态图片调整大小和转换功能。
该服务器实施安全控制以防止代理滥用和未经授权的盗链。这些包括使用 HMAC 的请求签名验证、基于允许列表的远程主机源过滤以及引用来源限制。它还利用 MIME 类型内容过滤来确保仅处理受支持的文件格式。
该项目包含一个缓存层，用于将处理后的图片存储在内存、本地磁盘或通过云存储提供商中。它支持动态图片转换，包括即时调整尺寸、裁剪、旋转和翻转资产。
Features
- Programmatic Resizing and Cropping - Provides programmatic image resizing and cropping through a proxy layer using API-driven parameters.
- On-the-Fly Transformations - Performs image resizing and cropping in memory during the request-response cycle.
- Image Proxy Caches - Caches processed versions of remote images locally to reduce bandwidth and improve page load speeds.
- URL-Driven Image Transformations - Adjusts image dimensions, crops, rotates, and flips assets dynamically via parameters in the request URL.
- Image Processing Servers - Operates as an HTTP server that fetches, resizes, and caches remote images via URL parameters.
- Request Signature Verification - Verifies the integrity and authenticity of requests using cryptographic signatures to prevent unauthorized proxy usage.
- Secure Image Delivery - Protects image processing services from abuse using signed URLs and domain restrictions.
- Domain Allow-Lists - Implements security controls that validate remote hosts against a trusted list before fetching images.
- Request Signing - Uses HMAC-based cryptographic signatures in URLs to verify the authenticity of transformation requests.
- Remote Source Restrictions - Limits external hosts the proxy can fetch images from using allow-lists and deny-lists.
- Asset Proxy Security - Prevents unauthorized access and hotlinking using request signing and referrer restrictions.
- Transformation Parameters - Parses request path parameters to determine the specific scaling, cropping, and rotation operations to apply.
- Image Caches - Implements a caching layer for image data with configurable storage backends to reduce latency.
- Processed Image Caching - Stores generated image variants in memory, on disk, or in the cloud to avoid redundant processing.
- Content-Type Filtering - Inspects response headers to ensure only supported image MIME types are processed by the proxy.
- Referrer-Based Access Control - Blocks requests not originating from a list of trusted HTTP referrers to prevent unauthorized hotlinking.
- Dynamic Asset Delivery - Optimizes the delivery of processed images through a secure gateway and caching layer for faster response times.
- Pluggable Cache Backends - Provides a pluggable interface for caching processed images in memory, on disk, or in cloud storage.
