ImageResizer.Plugins.RemoteReader 5.0.11-preview08

The ID prefix of this package has been reserved for one of the owners of this package by NuGet.org. Prefix Reserved
This is a prerelease version of ImageResizer.Plugins.RemoteReader.
There is a newer prerelease version of this package available.
See the version list below for details.
dotnet add package ImageResizer.Plugins.RemoteReader --version 5.0.11-preview08
NuGet\Install-Package ImageResizer.Plugins.RemoteReader -Version 5.0.11-preview08
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="ImageResizer.Plugins.RemoteReader" Version="5.0.11-preview08" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add ImageResizer.Plugins.RemoteReader --version 5.0.11-preview08
#r "nuget: ImageResizer.Plugins.RemoteReader, 5.0.11-preview08"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install ImageResizer.Plugins.RemoteReader as a Cake Addin
#addin nuget:?package=ImageResizer.Plugins.RemoteReader&version=5.0.11-preview08&prerelease

// Install ImageResizer.Plugins.RemoteReader as a Cake Tool
#tool nuget:?package=ImageResizer.Plugins.RemoteReader&version=5.0.11-preview08&prerelease

ImageResizer.Plugins.RemoteReader

The RemoteReader plugin allows the ImageResizer to resize and display images that are located at any URL. Kind of like a resizing relay.

There are 3 layers of security to prevent abuse.

  1. The API signs the remote URL with HMAC SHA-256 to prevent anyone from tampering or generating them without access to the signing key.
  2. A whitelist approach is taken to sites. By default, no sites are allowed. You must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event to permit sites (or portions of sites) to be relayed.
  3. The plugin requires that all remote images be decoded and re-encoded. Files are never returned as-is. This ensures that the files are valid images, and prevents XSS attacks. This means that without a querystring, /remote/ image requests will not work.

dot

Syntax

There are two syntax options.

  1. Using a signed remote URL. (Using RemoteReaderPlugin.Current.CreateSignedUrl(remoteUrl, resizingSettings) <br /> http://mysite.com/remote.jpg.ashx?width=100&height=200&urlb64=45b45c4a2099b...&hmac=a2099ba2099b

  2. Use a human-friendly syntax where the domain name is specified as a folder. http://mysite.com/remote/othersite.com/otherfolder/image.jpg?width=100&height=200

It is possible to set 'allowAllSignedRequests=true', but you must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event and set args.DenyRequest=false to allow the human-friendly syntax to work.

Installation

  1. Add ImageResizer.Plugins.RemoteReader.dll to your project or run Install-Package ImageResizer.Plugins.RemoteReader.
  2. Add <add name="RemoteReader" /> inside <resizer><plugins></plugins></resizer> in Web.config.
  3. Add <remotereader signingKey="put a long and very secure key here"></remotereader> inside <resizer></resizer>. Make sure the key is kept safe, and is the same across all servers in the web farm (if you're using one). This key can contain any XML-safe characters, and should be as long as possible. URLs generated with one key will not work with another.

Configuration reference

<configuration> <resizer> <remotereader signingKey="ag383ht23sag#laf#lafF#oyfafqewt;2twfqw" allowAllSignedRequests="false" allowRedirects="5"> <allow domain="imageresizing.net" /> <allow domain="*.imageresizing.net" onlyWhenSigned="true"/> </remotereader> <plugins> <add name="RemoteReader" /> </plugins> </resizer> </configuration>

AllowRedirects

Redirects are supported, but default behavior is to throw a 500 error if more than 5 are used. You can configure the number of followed redirects with the allowRedirects setting, or set it to 0 to disable following redirects.

Exceptions

404 errors are turned into FileNotFoundExceptions, which are turned back into 404 errors in the URL API. 403 errors are turned into 403 HttpExceptions.

All other exceptions are WebExceptions

Example event handler for whitelisting part of a website for relay

using ImageResizer.Plugins.RemoteReader;

protected void Application_Start(object sender, EventArgs e) {
  RemoteReaderPlugin.Current.AllowRemoteRequest += Current_AllowRemoteRequest;
}

static void Current_AllowRemoteRequest(object sender, RemoteRequestEventArgs args) {
  if (args.RemoteUrl.StartsWith("http://atrustedwebsite.com/photos/", StringComparison.OrdinalIgnoreCase))
    args.DenyRequest = false;
}

Example code for generating a signed URL

using ImageResizer.Plugins.RemoteReader;

img1.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://atrustedwebsite.com/photos/leaf.jpg", 
                                      new ResizeSettings("width=200&height=100"));
//For the following to work, allowAllSignedRequests must be true
img2.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://arandomwebsite.com/photos/leaf.jpg", 
                                      new ResizeSettings("width=200&height=100"));

Limitations of human-friendly syntax

The human-friendly syntax has to go through the IIS and ASP.NET request filtering/normalization system, which may cause issues if your URLs have special characters or spaces.

In 3.1.5 and higher, spaces are supported in URLs, but to support '+' characters in remote URLs, you have to make a change in Web.config, as IIS considers '+' dangerous by default ... for unknown reasons.

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="True"/>
    </security>
</system.webServer>

Proxy auto-detection

.NET automatically attempts to detect the proxy configuration each time the application starts. To prevent this (often) unnecessary 2-10 second delay, you can disable proxy detection in web.config (below).

<configuration>
  <system.net>
    <defaultProxy enabled="false">
    </defaultProxy>
  </system.net>
</configuration>
Product Compatible and additional computed target framework versions.
.NET Framework net472 is compatible.  net48 was computed.  net481 was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
5.0.13-preview09 202 9/30/2023
5.0.11-preview08 305 12/23/2022
5.0.10-preview07 356 11/17/2022
5.0.9-preview06 360 11/4/2022
5.0.8-preview05 310 11/4/2022
5.0.7-preview-04 329 10/14/2022
5.0.6-preview03 344 10/14/2022
5.0.5-preview02 316 9/29/2022
5.0.4-preview01 368 8/26/2022
5.0.3-preview04 330 8/26/2022
5.0.2-preview03 347 8/25/2022
5.0.1-preview02 325 8/25/2022
4.2.8 43,599 7/31/2020
4.2.7-pre 579 7/14/2020
4.2.6-pre 736 11/2/2019
4.2.5 89,393 4/6/2018
4.2.5-pre 996 2/19/2018
4.2.4-pre 1,146 12/13/2017
4.2.3-pre 982 12/13/2017
4.2.1-pre 993 11/29/2017
4.2.0 7,697 11/28/2017
4.1.11 1,429 11/8/2017
4.1.10 2,672 9/13/2017
4.1.9 31,608 6/22/2017
4.1.8 1,331 6/17/2017
4.1.7 1,351 6/6/2017
4.1.7-rc 991 6/5/2017
4.1.6-rc 977 6/1/2017
4.1.5-rc 1,063 6/1/2017
4.1.4-rc 970 5/11/2017
4.1.3-rc 1,055 5/11/2017
4.1.3-preview 1,093 5/6/2017
4.1.3-beta 1,008 5/5/2017
4.0.5 7,870 1/31/2016
4.0.4 2,753 10/25/2015
4.0.3 1,397 10/25/2015
4.0.2 1,368 10/25/2015
4.0.1 1,368 10/25/2015
4.0.0-prerelease0881 1,796 8/11/2015
4.0.0-prerelease0877 1,077 7/7/2015
3.4.3 20,218 5/8/2014
3.4.2 10,281 11/26/2013
3.4.1 1,624 10/30/2013
3.4.0 1,615 10/17/2013
3.3.3 2,825 3/2/2013
3.3.2 1,662 1/24/2013
3.3.1 1,648 12/20/2012
3.3.0 1,842 12/4/2012
3.2.4 2,372 8/6/2012
3.2.3 1,743 6/30/2012
3.2.2 1,621 6/20/2012
3.2.1 1,661 6/4/2012
3.2.0 1,633 6/3/2012
3.1.5 1,828 2/22/2012
3.1.4 1,768 1/22/2012
3.1.3 1,765 1/14/2012
3.1.2 1,738 12/7/2011
3.0.13 1,837 10/23/2011
3.0.12 1,893 8/15/2011
3.0.11 1,854 7/28/2011