The RemoteReader plugin allows the ImageResizer to resize and display images that are located at any URL. Kind of like a resizing relay.
There are 3 layers of security to prevent abuse.
The API signs the remote URL with HMAC SHA-256 to prevent anyone from tampering or generating them without access to the signing key.
A whitelist approach is taken to sites. By default, no sites are allowed. You must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event to permit sites (or portions of sites) to be relayed.
The plugin requires that all remote images be decoded and re-encoded. Files are never returned as-is. This ensures that the files are valid images, and prevents XSS attacks. This means that without a querystring, /remote/ image requests will not work.
It is possible to set 'allowAllSignedRequests=true', but you must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event and set args.DenyRequest=false to allow the human-friendly syntax to work.
Installation
Add ImageResizer.Plugins.RemoteReader.dll to your project or run Install-Package ImageResizer.Plugins.RemoteReader.
Add <add name="RemoteReader" /> inside <resizer><plugins></plugins></resizer> in Web.config.
Add <remotereader signingKey="put a long and very secure key here"></remotereader> inside <resizer></resizer>. Make sure the key is kept safe, and is the same across all servers in the web farm (if you're using one). This key can contain any XML-safe characters, and should be as long as possible. URLs generated with one key will not work with another.
Redirects are supported, but default behavior is to throw a 500 error if more than 5 are used. You can configure the number of followed redirects with the allowRedirects setting, or set it to 0 to disable following redirects.
Exceptions
404 errors are turned into FileNotFoundExceptions, which are turned back into 404 errors in the URL API.
403 errors are turned into 403 HttpExceptions.
All other exceptions are WebExceptions
Example event handler for whitelisting part of a website for relay
using ImageResizer.Plugins.RemoteReader;
img1.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://atrustedwebsite.com/photos/leaf.jpg",
new ResizeSettings("width=200&height=100"));
//For the following to work, allowAllSignedRequests must be true
img2.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://arandomwebsite.com/photos/leaf.jpg",
new ResizeSettings("width=200&height=100"));
Limitations of human-friendly syntax
The human-friendly syntax has to go through the IIS and ASP.NET request filtering/normalization system, which may cause issues if your URLs have special characters or spaces.
In 3.1.5 and higher, spaces are supported in URLs, but to support '+' characters in remote URLs, you have to make a change in Web.config, as IIS considers '+' dangerous by default ... for unknown reasons.
.NET automatically attempts to detect the proxy configuration each time the application starts. To prevent this (often) unnecessary 2-10 second delay, you can disable proxy detection in web.config (below).
