Cat agoraphobia - An epidemic?

Protecting Origin Images

14 min ago 16 comments
By Pugsy Malone

This page demonstrates a different approach to handling the absence of a policy or query parameters, by returning a 404 for invalid requests.


  table io_policies {
    "article-main": "crop=660:438&width=660",
    "article-large": "crop=318:212&width=318",
    "article-medium": "crop=250:166&width=250",
    "thumb": "crop=80:53&width=80",
    "avatar": "crop=1:1&width=150",
  }
  

  sub vcl_recv {
  #FASTLY recv

    // Return non-image
    if (req.url.path !~ "(?i)\.(?:jpg|png)$" 
      || req.url.path !~ "/images/") {
      return(lookup);
    }

    // Signal to send to IO
    set req.http.X-Fastly-Imageopto-Api = "fastly";

    // Don't alter the request if we're running at 
    // the shield, it has already been rewritten
    if (req.http.Fastly-FF) {
        return (lookup);
    }
    
    // Protecting Origin images by returning a 404
    if (req.url.qs !~ "(?:^|&)policy=([^&]+)"
        || !table.lookup(io_policies, re.group.1)) {
      error 404;
    } 
    set req.url = req.url.path "?" 
                  table.lookup(io_policies, re.group.1);

  }
                

  //facepug.io/images/a8/cat-agro.jpg?policy=article-main

  //facepug.io/images/a8/cat-agro.jpg
Share this story

popular