URL Signature

[mdmm13]

Thanks for this fantastic repo @shinsenter.

You're bypassing URL signatures by default and it's not possible with the current NGINX rules to add them back. Would you mind commenting on

1. How this setup is secure since anyone can DOS a given URL without signature or are you suggesting moving that to NGINX?
2. How one could enable URL signatures if one wanted to?

[shinsenter]

Hi @mdmm13

Thank you for your interest and for posing your question. I'll address your inquiries individually based on my knowledge.

How this setup is secure since anyone can DOS a given URL without signature or are you suggesting moving that to NGINX?

In terms of mitigating DoS attacks, one effective strategy is to implement rewrite rules to restrict access to specific parameters that are necessary. For instance, in my current setup, I only allow resizing for images with fixed widths of 200, 640, 800, 1200, and 1600 pixels. Any other sizes default to 200 pixels.

docker-imgproxy/imgproxy.conf

Lines 132 to 142 in 0d0bbe8

	# You can define dynamic presets,
	#> but beware that dynamic presets are able to cause a denial-of-service attack
	#> by allowing an attacker to request multiple different image resizes.
	#> E.g. a dynamic preset with a variable $width.
	# ~^/_w(?<parsed_width>[0-9_-]+)/ 'max_w:${parsed_width}';
	# This is a better version for above dynamic preset.
	#> It allows only certain image sizes,
	#> and fallbacks other undefined image sizes to max_w:200
	~^/_w(?<parsed_width>(200|640|800|1200|1600))/ 'max_w:${parsed_width}';
	~^/_w(?<parsed_width>([0-9_-]+))/ 'max_w:200';

Additionally, implementing proxy caching between nginx and imgproxy can also significantly reduce the number of requests reaching imgproxy.

docker-imgproxy/nginx/nginx.conf

Lines 207 to 209 in 0d0bbe8

	proxy_cache $imgproxy_cache;
	proxy_cache_key $imgproxy_rewrite;
	proxy_pass http://upstream_imgproxy${imgproxy_rewrite};

And if you use a CDN, this DoS limitation will be even more effective.

How one could enable URL signatures if one wanted to?

The main objective of my project is to minimize the number of parameters and URL signatures required for image query URLs. If you're interested in incorporating URL signatures into your setup, you can refer to how I utilize rewrite rules to achieve a similar outcome for adding URL signatures to imgproxy queries.

Best regard