ImageResizer.Plugins.RemoteReader 5.0.13-preview09

The ID prefix of this package has been reserved for one of the owners of this package by NuGet.org. Prefix Reserved
This is a prerelease version of ImageResizer.Plugins.RemoteReader.
dotnet add package ImageResizer.Plugins.RemoteReader --version 5.0.13-preview09
NuGet\Install-Package ImageResizer.Plugins.RemoteReader -Version 5.0.13-preview09
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="ImageResizer.Plugins.RemoteReader" Version="5.0.13-preview09" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add ImageResizer.Plugins.RemoteReader --version 5.0.13-preview09
#r "nuget: ImageResizer.Plugins.RemoteReader, 5.0.13-preview09"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install ImageResizer.Plugins.RemoteReader as a Cake Addin
#addin nuget:?package=ImageResizer.Plugins.RemoteReader&version=5.0.13-preview09&prerelease

// Install ImageResizer.Plugins.RemoteReader as a Cake Tool
#tool nuget:?package=ImageResizer.Plugins.RemoteReader&version=5.0.13-preview09&prerelease

ImageResizer.Plugins.RemoteReader

The RemoteReader plugin allows the ImageResizer to resize and display images that are located at any URL. Kind of like a resizing relay.

There are 3 layers of security to prevent abuse.

  1. The API signs the remote URL with HMAC SHA-256 to prevent anyone from tampering or generating them without access to the signing key.
  2. A whitelist approach is taken to sites. By default, no sites are allowed. You must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event to permit sites (or portions of sites) to be relayed.
  3. The plugin requires that all remote images be decoded and re-encoded. Files are never returned as-is. This ensures that the files are valid images, and prevents XSS attacks. This means that without a querystring, /remote/ image requests will not work.

dot

Syntax

There are two syntax options.

  1. Using a signed remote URL. (Using RemoteReaderPlugin.Current.CreateSignedUrl(remoteUrl, resizingSettings) <br /> http://mysite.com/remote.jpg.ashx?width=100&height=200&urlb64=45b45c4a2099b...&hmac=a2099ba2099b

  2. Use a human-friendly syntax where the domain name is specified as a folder. http://mysite.com/remote/othersite.com/otherfolder/image.jpg?width=100&height=200

It is possible to set 'allowAllSignedRequests=true', but you must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event and set args.DenyRequest=false to allow the human-friendly syntax to work.

Installation

  1. Add ImageResizer.Plugins.RemoteReader.dll to your project or run Install-Package ImageResizer.Plugins.RemoteReader.
  2. Add <add name="RemoteReader" /> inside <resizer><plugins></plugins></resizer> in Web.config.
  3. Add <remotereader signingKey="put a long and very secure key here"></remotereader> inside <resizer></resizer>. Make sure the key is kept safe, and is the same across all servers in the web farm (if you're using one). This key can contain any XML-safe characters, and should be as long as possible. URLs generated with one key will not work with another.

Configuration reference

<configuration> <resizer> <remotereader signingKey="ag383ht23sag#laf#lafF#oyfafqewt;2twfqw" allowAllSignedRequests="false" allowRedirects="5"> <allow domain="imageresizing.net" /> <allow domain="*.imageresizing.net" onlyWhenSigned="true"/> </remotereader> <plugins> <add name="RemoteReader" /> </plugins> </resizer> </configuration>

AllowRedirects

Redirects are supported, but default behavior is to throw a 500 error if more than 5 are used. You can configure the number of followed redirects with the allowRedirects setting, or set it to 0 to disable following redirects.

Exceptions

404 errors are turned into FileNotFoundExceptions, which are turned back into 404 errors in the URL API. 403 errors are turned into 403 HttpExceptions.

All other exceptions are WebExceptions

Example event handler for whitelisting part of a website for relay

using ImageResizer.Plugins.RemoteReader;

protected void Application_Start(object sender, EventArgs e) {
  RemoteReaderPlugin.Current.AllowRemoteRequest += Current_AllowRemoteRequest;
}

static void Current_AllowRemoteRequest(object sender, RemoteRequestEventArgs args) {
  if (args.RemoteUrl.StartsWith("http://atrustedwebsite.com/photos/", StringComparison.OrdinalIgnoreCase))
    args.DenyRequest = false;
}

Example code for generating a signed URL

using ImageResizer.Plugins.RemoteReader;

img1.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://atrustedwebsite.com/photos/leaf.jpg", 
                                      new ResizeSettings("width=200&height=100"));
//For the following to work, allowAllSignedRequests must be true
img2.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://arandomwebsite.com/photos/leaf.jpg", 
                                      new ResizeSettings("width=200&height=100"));

Limitations of human-friendly syntax

The human-friendly syntax has to go through the IIS and ASP.NET request filtering/normalization system, which may cause issues if your URLs have special characters or spaces.

In 3.1.5 and higher, spaces are supported in URLs, but to support '+' characters in remote URLs, you have to make a change in Web.config, as IIS considers '+' dangerous by default ... for unknown reasons.

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="True"/>
    </security>
</system.webServer>

Proxy auto-detection

.NET automatically attempts to detect the proxy configuration each time the application starts. To prevent this (often) unnecessary 2-10 second delay, you can disable proxy detection in web.config (below).

<configuration>
  <system.net>
    <defaultProxy enabled="false">
    </defaultProxy>
  </system.net>
</configuration>
Product Compatible and additional computed target framework versions.
.NET Framework net472 is compatible.  net48 was computed.  net481 was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
5.0.13-preview09 228 9/30/2023
5.0.11-preview08 337 12/23/2022
5.0.10-preview07 382 11/17/2022
5.0.9-preview06 381 11/4/2022
5.0.8-preview05 330 11/4/2022
5.0.7-preview-04 350 10/14/2022
5.0.6-preview03 364 10/14/2022
5.0.5-preview02 339 9/29/2022
5.0.4-preview01 400 8/26/2022
5.0.3-preview04 351 8/26/2022
5.0.2-preview03 365 8/25/2022
5.0.1-preview02 347 8/25/2022
4.2.8 44,847 7/31/2020
4.2.7-pre 604 7/14/2020
4.2.6-pre 761 11/2/2019
4.2.5 91,837 4/6/2018
4.2.5-pre 1,021 2/19/2018
4.2.4-pre 1,166 12/13/2017
4.2.3-pre 1,006 12/13/2017
4.2.1-pre 1,015 11/29/2017
4.2.0 7,729 11/28/2017
4.1.11 1,458 11/8/2017
4.1.10 2,703 9/13/2017
4.1.9 31,842 6/22/2017
4.1.8 1,360 6/17/2017
4.1.7 1,383 6/6/2017
4.1.7-rc 1,016 6/5/2017
4.1.6-rc 1,001 6/1/2017
4.1.5-rc 1,087 6/1/2017
4.1.4-rc 994 5/11/2017
4.1.3-rc 1,078 5/11/2017
4.1.3-preview 1,118 5/6/2017
4.1.3-beta 1,031 5/5/2017
4.0.5 7,927 1/31/2016
4.0.4 2,796 10/25/2015
4.0.3 1,429 10/25/2015
4.0.2 1,404 10/25/2015
4.0.1 1,402 10/25/2015
4.0.0-prerelease0881 1,832 8/11/2015
4.0.0-prerelease0877 1,103 7/7/2015
3.4.3 20,520 5/8/2014
3.4.2 10,810 11/26/2013
3.4.1 1,651 10/30/2013
3.4.0 1,643 10/17/2013
3.3.3 2,852 3/2/2013
3.3.2 1,693 1/24/2013
3.3.1 1,678 12/20/2012
3.3.0 1,870 12/4/2012
3.2.4 2,425 8/6/2012
3.2.3 1,773 6/30/2012
3.2.2 1,650 6/20/2012
3.2.1 1,686 6/4/2012
3.2.0 1,660 6/3/2012
3.1.5 1,855 2/22/2012
3.1.4 1,794 1/22/2012
3.1.3 1,790 1/14/2012
3.1.2 1,767 12/7/2011
3.0.13 1,863 10/23/2011
3.0.12 1,919 8/15/2011
3.0.11 1,880 7/28/2011