go/imgproxy
1
0
Fork 0
mirror of https://github.com/imgproxy/imgproxy.git synced 2025-01-18 11:12:10 +02:00
Code Releases Activity

Prevent direct requests with X-Imgproxy-Secret header

Browse Source
This commit is contained in:
DarthSim 2017-07-02 03:25:08 +06:00
parent 69b607cd98
commit fa5cf7045e
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config.go
View File

@ -70,6 +70,8 @@ type config struct {
Key []byte Key []byte
Salt []byte Salt []byte
Secret string
} }
var conf = config{ var conf = config{
@ -101,6 +103,8 @@ func init() {
hexFileConfig(&conf.Key, *keypath) hexFileConfig(&conf.Key, *keypath)
hexFileConfig(&conf.Salt, *saltpath) hexFileConfig(&conf.Salt, *saltpath)
strEnvConfig(&conf.Secret, "IMGPROXY_SECRET")
if len(conf.Key) == 0 { if len(conf.Key) == 0 {
log.Fatalln("Key is not defined") log.Fatalln("Key is not defined")
} }

17
server.go
View File

@ -3,6 +3,7 @@ package main
import ( import (
"bytes" "bytes"
"compress/gzip" "compress/gzip"
"crypto/subtle"
"encoding/base64" "encoding/base64"
"errors" "errors"
"fmt" "fmt"
@ -116,9 +117,25 @@ func respondWithError(rw http.ResponseWriter, status int, err error, msg string)
rw.Write([]byte(msg)) rw.Write([]byte(msg))
} }
func repondWithForbidden(rw http.ResponseWriter) {
logResponse(403, "Invalid secret")
rw.WriteHeader(403)
rw.Write([]byte("Forbidden"))
}
func checkSecret(s string) bool {
return len(conf.Secret) == 0 || subtle.ConstantTimeCompare([]byte(s), []byte(conf.Secret)) == 1
}
func (h httpHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) { func (h httpHandler) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
log.Printf("GET: %s\n", r.URL.RequestURI()) log.Printf("GET: %s\n", r.URL.RequestURI())
if !checkSecret(r.Header.Get("X-Imgproxy-Secret")) {
repondWithForbidden(rw)
return
}
imgURL, procOpt, err := parsePath(r) imgURL, procOpt, err := parsePath(r)
if err != nil { if err != nil {
respondWithError(rw, 404, err, "Invalid image url") respondWithError(rw, 404, err, "Invalid image url")