Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove referer header from cache key when S3 is used #87

Closed
ofhouse opened this issue Nov 22, 2021 · 0 comments · Fixed by #91
Closed

Remove referer header from cache key when S3 is used #87

ofhouse opened this issue Nov 22, 2021 · 0 comments · Fixed by #91
Labels
enhancement New feature or request
Milestone

Comments

@ofhouse
Copy link
Member

ofhouse commented Nov 22, 2021

When an S3 bucket is used as source for absolute URIs (e.g. /my/image.png), the Referer is not used to determine the origin host.
However it is still added to the cache-key that could be a security risk.

Referer header

The referer header was added to the cache-key as a way to determine the the correct host for relative paths.
For example the request example.com/_next/image?url=/image.png would have the Referer: example.com as header, when an embedded resource is requested by the browser.
So the image optimizer is then able to resolve the absolute URL for the image from it: example.com/image.png.

This was meant as an easy way to integrate, but we should change it in the following way:

  1. Since there is also an option to connect an S3 bucket, we should remove the header from the cache-key when a S3 bucket is connected.
  2. For other use cases we should also offer an option to specify the domain for relative paths via an input parameter to the module so that the referer header can be removed from the cache-key.
  3. If 1 & 2 are not used, the referer header is added to the cache-key.

x-ref: #75

@ofhouse ofhouse added the enhancement New feature or request label Nov 22, 2021
@ofhouse ofhouse added this to the v12.0.0 milestone Nov 22, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant