weserv / images

Source code of wsrv.nl (formerly images.weserv.nl), to be used on your own server(s).
https://wsrv.nl/
BSD 3-Clause "New" or "Revised" License
1.86k stars 187 forks source link

How should I request images over https? #299

Closed GitBoudewijn closed 2 years ago

GitBoudewijn commented 2 years ago

Is it correct that https://images.weserv.nl/?url=images.weserv.nl/lichtenstein.jpg is the same as https://images.weserv.nl/?url=http://images.weserv.nl/lichtenstein.jpg?

When I want to request an image via https should I use https://images.weserv.nl/?url=https://images.weserv.nl/lichtenstein.jpg or https://images.weserv.nl/?url=ssl:images.weserv.nl/lichtenstein.jpg?

Also are they cached seperately by your servers? What if the http url redirects to the https url?

I can't find this behaviour described anywhere in the documentation.

kleisauke commented 2 years ago

Is it correct that https://images.weserv.nl/?url=images.weserv.nl/lichtenstein.jpg is the same as https://images.weserv.nl/?url=http://images.weserv.nl/lichtenstein.jpg?

That's correct. Both given URLs will send an HTTP-request to http://images.weserv.nl/lichtenstein.jpg, see: https://github.com/weserv/images/blob/a6d646643ab24aaad4a0a42bb83383d850d5b3e6/src/nginx/uri_parser.cpp#L456-L458

When I want to request an image via https should I use https://images.weserv.nl/?url=https://images.weserv.nl/lichtenstein.jpg or https://images.weserv.nl/?url=ssl:images.weserv.nl/lichtenstein.jpg?

Although there's no difference, I can recommend just using the https://… variant. The ssl:… variant is kept for backwards compatibility as BBCode parsers could fail on the double http(s)://-part, see: https://images.weserv.nl/news/2018/07/29/introducing-api-4/#flexible-uri-parser

Note that schemaless (//) URLs will default to HTTPS: https://github.com/weserv/images/blob/a6d646643ab24aaad4a0a42bb83383d850d5b3e6/src/nginx/uri_parser.cpp#L451-L452

Also are they cached seperately by your servers? What if the http url redirects to the https url?

The cache key is based on the URL and given parameters, so the above mentioned URLs will all be cached separately. By default, a maximum of 10 redirects are followed (this can be configured with the weserv_max_redirects directive). So, if the upstream server will redirect to a HTTPS URL it will be automatically followed.

I can't find this behaviour described anywhere in the documentation.

I'm happy to accept a PR that clarifies this.