You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When an S3 bucket is used as source for absolute URIs (e.g. /my/image.png), the Referer is not used to determine the origin host.
However it is still added to the cache-key that could be a security risk.
Referer header
The referer header was added to the cache-key as a way to determine the the correct host for relative paths.
For example the request example.com/_next/image?url=/image.png would have the Referer: example.com as header, when an embedded resource is requested by the browser.
So the image optimizer is then able to resolve the absolute URL for the image from it: example.com/image.png.
This was meant as an easy way to integrate, but we should change it in the following way:
Since there is also an option to connect an S3 bucket, we should remove the header from the cache-key when a S3 bucket is connected.
For other use cases we should also offer an option to specify the domain for relative paths via an input parameter to the module so that the referer header can be removed from the cache-key.
If 1 & 2 are not used, the referer header is added to the cache-key.
When an S3 bucket is used as source for absolute URIs (e.g.
/my/image.png
), theReferer
is not used to determine the origin host.However it is still added to the cache-key that could be a security risk.
x-ref: #75
The text was updated successfully, but these errors were encountered: