Rewrite image urls to exclude unwanted params #86
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
next.config.js
Outdated
| { | ||
| source: '/_next/image', | ||
| destination: '/_next/image?url=:url', | ||
| has: [{type: 'query', key: 'url', value: '(?<url>.*[jpg|png|jpeg|gif]\?itok=\\w+).*'}] |
There was a problem hiding this comment.
Looks smart.
Any exotic files like (webp, SVG)?
Is itok always the first parameter after the ??
There was a problem hiding this comment.
no webp, or svg uploads are allowed.
It should always be the first parameter if the data comes from Drupal.. i guess this probably wouldn't help it if bots remove the itok param
There was a problem hiding this comment.
I added some logic to also check for image urls without the itok param. It'll return a default image as a fallback.
A few scenarios:
https://domain.edu/_next/image?url=https://google.....-> this will automatically be blocked due to theimages.domainssettings only allowing configured domains.https://domain.edu/_next/image?url=https://drupal/path/to/image.jpg-> this will go to the no-image since drupal will block it anyways without the itok paramhttps://domain.edu/_next/image?url=https://drupal/path/to/image.jpg?itok=abc-12_3-> this will not be changed.https://domain.edu/_next/image?url=https://drupal/path/to/image.jpg?foo=bar&itok=abc-12_3-> this will go to no-image since it's likely malicious.https://domain.edu/_next/image?url=https://drupal/path/to/image.jpg?itok=abc-12_3&foo=bar...-> this will rewrite tohttps://domain.edu/_next/image?url=https://drupal/path/to/image.jpg?itok=abc-12_3. This doesn't block bots, but it should reduce the variety of unique images being derived.
Can you think of any other scenarios?
There was a problem hiding this comment.
I think that should cover it. In a nutshell, you're looking for a valid-looking URL with only the parameters you want and everything else gets sent to the no-image file, which will be cached after the first time it's hit. Bots could still troll valid image paths and their derivatives but that is a different issue than cache-busting URLs.
READY FOR REVIEW/NOT READY
Summary
Review By (Date)
Urgency
Steps to Test
Affected Projects or Products
Associated Issues and/or People
@mentionthem here)See Also