[GH-ISSUE #96] [RFC] Add signature generation #36

New issue

Closed

opened 2026-02-25 22:34:12 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 22:34:12 +03:00

Owner

Originally created by @joelwurtz on GitHub (Jul 10, 2017).
Original GitHub issue: https://github.com/flyimg/flyimg/issues/96

Originally assigned to: @sadok-f on GitHub.

Hey,

Didn't find this in the doc, but maybe it's already implemented ?

Goal of this RFC is to be able to use flyimg as a public hosting media (no domain restriction) but still provides security to avoid "bad" users to generate their owns image (like doing a loop with +1 pixel width) and doing a DDOS attack.

A way to achieve that is to have on the page creating the url to this service, and on flyimage a shared key whichs allows to encode all the parameters with the url into a signature, and check this on the server (if signature invalid throw a 403 / 404 ?). It's very similar on how thumbor works.

WDYT ?

Originally created by @joelwurtz on GitHub (Jul 10, 2017). Original GitHub issue: https://github.com/flyimg/flyimg/issues/96 Originally assigned to: @sadok-f on GitHub. Hey, Didn't find this in the doc, but maybe it's already implemented ? Goal of this RFC is to be able to use flyimg as a public hosting media (no domain restriction) but still provides security to avoid "bad" users to generate their owns image (like doing a loop with +1 pixel width) and doing a DDOS attack. A way to achieve that is to have on the page creating the url to this service, and on flyimage a shared key whichs allows to encode all the parameters with the url into a signature, and check this on the server (if signature invalid throw a 403 / 404 ?). It's very similar on how thumbor works. WDYT ?

kerem

2026-02-25 22:34:12 +03:00

closed this issue
added the
enhancement

Security
labels

kerem commented

2026-02-25 22:34:13 +03:00

Author

Owner

@sadok-f commented on GitHub (Jul 11, 2017):

@joelwurtz Indeed this PR is a must have on Flyimg.
Currently, only the restricted domains are the only the security layer, the server could fail with DDOS.
I checked Thumbor implementation
https://github.com/thumbor/thumbor/wiki/Security
Very straightforward and simple to implement, We hope we can add this soon.
Many thanks for raising this topic.

@sadok-f commented on GitHub (Jul 11, 2017): @joelwurtz Indeed this PR is a must have on Flyimg. Currently, only the restricted domains are the only the security layer, the server could fail with DDOS. I checked Thumbor implementation https://github.com/thumbor/thumbor/wiki/Security Very straightforward and simple to implement, We hope we can add this soon. Many thanks for raising this topic.

kerem referenced this issue

2026-02-25 22:34:49 +03:00

[PR #36] [MERGED] Make Homepage helpful, add Twig as tmpl engine #240

kerem referenced this issue

2026-03-15 15:39:01 +03:00

[PR #36] [MERGED] Make Homepage helpful, add Twig as tmpl engine #849