[GH-ISSUE #357] forward authorization headers from client request to origin server request #757

New issue

Closed

opened 2026-03-15 15:18:02 +03:00 by kerem · 3 comments

kerem commented

2026-03-15 15:18:02 +03:00

Owner

Originally created by @lorello on GitHub (Sep 21, 2023).
Original GitHub issue: https://github.com/flyimg/flyimg/issues/357

Hi guys,
we are using flyimg in a sort of ticket system. Users can add screenshots or photos to their tickets, these files are private, to access them we need to supply a Bearer token to the original image server. We'd like to use flyimg to serve smaller preview of these attachments, but currently flyimg doesn't pass original authorization request headers to the origin server that hosts attachments, is this a interesting feature that we could add? If yes, we could send a PR.

We could add an option like extra_header_options, could be:
original_headers_whitelist that list all the headers that from the client request must be forwarded to the origin request.

This option should be used in saveToTemporaryFile method

What do you think?

Originally created by @lorello on GitHub (Sep 21, 2023). Original GitHub issue: https://github.com/flyimg/flyimg/issues/357 Hi guys, we are using flyimg in a sort of ticket system. Users can add screenshots or photos to their tickets, these files are private, to access them we need to supply a Bearer token to the original image server. We'd like to use flyimg to serve smaller preview of these attachments, but currently flyimg doesn't pass original authorization request headers to the origin server that hosts attachments, is this a interesting feature that we could add? If yes, we could send a PR. We could add an option like [extra_header_options](https://github.com/flyimg/flyimg/blob/c387c62b77591b7da1e2465a3f4eb1c8d78e9e7a/config/parameters.yml#L40), could be: `original_headers_whitelist` that list all the headers that from the client request must be forwarded to the origin request. This option should be used in [saveToTemporaryFile](https://github.com/flyimg/flyimg/blob/c387c62b77591b7da1e2465a3f4eb1c8d78e9e7a/src/Core/Entity/Image/InputImage.php#L82) method What do you think?

kerem

2026-03-15 15:18:02 +03:00

closed this issue
added the
enhancement

version 1
labels

kerem commented

2026-03-15 15:18:19 +03:00

Author

Owner

@sadok-f commented on GitHub (Sep 21, 2023):

Hi @lorello ,

Thank you for opening up this issue!
It's a great idea, would be great if you could submit a PR!
maybe the option would be a bool variable, called forward_request_headers default to false and when it is set to true it forwards all client headers to the origin image url.

@sadok-f commented on GitHub (Sep 21, 2023): Hi @lorello , Thank you for opening up this issue! It's a great idea, would be great if you could submit a PR! maybe the option would be a bool variable, called `forward_request_headers` default to false and when it is set to true it forwards all client headers to the origin image url.

kerem commented

2026-03-15 15:18:24 +03:00

Author

Owner

@lorello commented on GitHub (Sep 22, 2023):

hi @sadok-f

Thank you for opening up this issue! It's a great idea, would be great if you could submit a PR!

as you can see my collegue @lrealdi has already implemented it and we are testing in our QA environment

maybe the option would be a bool variable, called forward_request_headers default to false and when it is set to true it forwards all client headers to the origin image url.

we cannot pass all the headers from client to origin, if we forward the Host: header the call obviously fails :-(
For this reason we opted for an array of headers

@lorello commented on GitHub (Sep 22, 2023): hi @sadok-f > Thank you for opening up this issue! It's a great idea, would be great if you could submit a PR! as you can see my collegue @lrealdi has already implemented it and we are testing in our QA environment > maybe the option would be a bool variable, called `forward_request_headers` default to false and when it is set to true it forwards all client headers to the origin image url. we cannot pass all the headers from client to origin, if we forward the `Host:` header the call obviously fails :-( For this reason we opted for an array of headers

kerem commented

2026-03-15 15:18:29 +03:00

Author

Owner

@sadok-f commented on GitHub (Sep 22, 2023):

Sorry @lorello, I didn't get it in the first comment.
Now I got it, yes makes sense what you propose.
please have a look at the PR's failed pipeline, there are a couple of small warnings regarding code listing and complexity.
would be great if you could add one unit test if possible.
Thank you!

@sadok-f commented on GitHub (Sep 22, 2023): Sorry @lorello, I didn't get it in the first comment. Now I got it, yes makes sense what you propose. please have a look at the PR's failed pipeline, there are a couple of small warnings regarding code listing and complexity. would be great if you could add one unit test if possible. Thank you!