RemoteReader plugin

The RemoteReader plugin allows the ImageResizer to resize and display images that are located at any URL. Kind of like a resizing relay.

There are 3 layers of security to prevent abuse.

The API signs the remote url with HMAC SHA-256 to prevent anyone from tampering or generating them without access to the signing key.
A whitelist approach is taken to sites. By default, no sites are allowed. You must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event to permit sites (or portions of sites) to be relayed.
The plugin requires that all remote images be decoded and re-encoded. Files are never returned as-is. This ensures that the files are valid images, and prevents XSS attacks. This means that without a querystring, /remote/ image requests will not work.

Syntax

There are two syntax options.

Using a signed remote URL. (Using RemoteReaderPlugin.Current.CreateSignedUrl(remoteUrl, resizingSettings)
http://mysite.com/remote.jpg.ashx?width=100&height=200&urlb64=45b45c4a2099b…&hmac=a2099ba2099b
Use a human-friendly syntax where the domain name is specified as a folder. http://mysite.com/remote/othersite.com/otherfolder/image.jpg?width=100&height=200

It is possible to set 'allowAllSignedRequests=true', but you must handle the RemoteReaderPlugin.Current.AllowRemoteRequest event and set args.DenyRequest=false to allow the human-friendly syntax to work.

Installation

Either run Install-Package ImageResizer.Plugins.RemoteReader in the NuGet package manager, then follow the 3rd step below, or:

Add ImageResizer.Plugins.RemoteReader.dll to your project
Add <add name="RemoteReader" /> inside <resizer><plugins></plugins></resizer> in Web.config.
Add <remotereader signingKey="put a long and very secure key here"></remotereader> inside <resizer></resizer>. Make sure the key is kept safe, and is the same across all servers in the web farm (if you're using one). This key can contain any xml-safe characters, and should be as long as possible. URLs generated with one key will not work with another.

Configuration reference

AllowRedirects (V3.1.5+)

In V3.1.5 and higher, redirects are supported, but the default is to throw a 500 error if more than 5 are used. You can configure the number of followed redirects with the allowRedirects setting, or set it to 0 to disable following redirects.

Exceptions

404 errors are turned into FileNotFoundExceptions, which are turned back into 404 errors in the URL API. 403 errors are turned into 403 HttpExceptions.

All other exceptions are WebExceptions

Example event handler for whitelisting part of a website for relay

using ImageResizer.Plugins.RemoteReader;

protected void Application_Start(object sender, EventArgs e) {
  RemoteReaderPlugin.Current.AllowRemoteRequest += Current_AllowRemoteRequest;
}

static void Current_AllowRemoteRequest(object sender, RemoteRequestEventArgs args) {
  if (args.RemoteUrl.StartsWith("http://atrustedwebsite.com/photos/", StringComparison.OrdinalIgnoreCase))
    args.DenyRequest = false;
}

Example code for generating a signed URL

using ImageResizer.Plugins.RemoteReader;

img1.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://atrustedwebsite.com/photos/leaf.jpg", 
                                      new ResizeSettings("width=200&height=100"));
//For the following to work, allowAllSignedRequests must be true
img2.ImageUrl = RemoteReaderPlugin.Current.CreateSignedUrl("http://arandomwebsite.com/photos/leaf.jpg", 
                                      new ResizeSettings("width=200&height=100"));

Limitations of human-friendly syntax

The human-friendly syntax has to go through the IIS and ASP.NET request filtering/normalization system, which may cause issues if your URLs have special characters or spaces.

In 3.1.5 and higher, spaces are supported in URLs, but to support '+' characters in remote URLs, you have to make a change in Web.config, as IIS considers '+' dangerous by default. IIS needs Prozac.

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="True"/>
    </security>
</system.webServer>

Proxy auto-detection

.NET automatically attempts to detect the proxy configuration each time the application starts. To prevent this (often) unnecessary 2-10 second delay, you can disable proxy detection in web.config (below).

<configuration>
  <system.net>
    <defaultProxy enabled="false">
    </defaultProxy>
  </system.net>
</configuration>

Non-ascii URLs

.NET requires a tiny bit of configuration to allow non-ascii characters in remote URLs.

This plugin (RemoteReader plugin) is part of the Performance Edition

Where is the plugins section?

The <plugins> section is located in Web.config, and is nested inside the <resizer> element, which is nested inside <configuration>. For examples, see this sample Web.config file.

Where can I find the dll?

We prefer that you install via NuGet, but you can also find the plugin DLL files in the /dlls/release folder of your download.

How do I typically install a plugin via Web.Config?

In Visual Studio, right click on your project and choose "Add reference". Browse to the plugin DLL and click "OK".
In the <plugins> section of Web.config, insert <add name="PluginName" />
Look at the plugin documentation to see what configuration options (if any) are available.

How do I typically install a plugin via code?