search

nuxt / image

Plug-and-play image optimization for Nuxt applications.
https://image.nuxt.com
MIT License
1.33k stars 271 forks source link

secure/signed URL support #276

Open pi0 opened 3 years ago

pi0 commented 3 years ago

Some providers like imgix (https://docs.imgix.com/setup/securing-images) or Cloudinary (https://cloudinary.com/documentation/control_access_to_media) support signing URLs to disallow an attacker generating an unlimited amount of URLs causing downtimes, unprivileged access, resource abuse, etc.

To properly supporting this, we need a server only mechanism that can sign URLs (if exposing tokens to the client-side, an attacker can still access them to sign!). This can be possible with a serverMiddleware or server-only plugin/runtimeConfig (example idea: https://github.com/nuxt/image/pull/205#issuecomment-817114276). And introducing new set of usage limitations. (thus needs discussion before trying to implement)

nathanchase commented 3 years ago

Here's ImageKit's signed URL documentation, for your consideration: https://docs.imagekit.io/features/security/signed-urls#generating-signed-urls-on-your-own

shadow81627 commented 3 years ago

Glide signed URL documentation: https://glide.thephpleague.com/2.0/config/security/

westende commented 2 years ago

@pi0 Why the need to wait for Nuxt 3 as you stated in #385? What are the usage limitations you mention?

BenjaminOddou commented 2 years ago

@pi0, is it possible to call signed url through Nuxt Image with Imagekit set as provider ?

everyx commented 1 year ago

@pi0 @danielroe, has there been any recent progress on this issue?