No Need to Protect Extensions

[oldcai]

The supported format of browsers/clients needed to be checked on the browser side or on the app side, if the extensions can be changed on the user side, it would be more convenient to use.

I've read in the document, the reason to protect URLs is to prevent DDOS attacks, but as the support of the extensions is limited, the harm is slight and I think the benefit is worth the cost?

By the way, thanks for your great efforts.
This project is awesome!

[DarthSim]

Hi! Thanks for trying out imgproxy!
What do mean by changing the extension on the user side? Could you give me an example?
The provided extension defines the resulting format of the image, so I can't drop it from the URL. The supported formats list is limited by libvips support.

[oldcai]

For example

A source image URL could be something like https://www.domain.com/VALIDATION/filename.png

Some browser could support WebP (and some don't), a javascript can check them out.

When the browser supports WebP, and the imgproxy do not care about the extension, the javascript only need to change the URL to https://www.domain.com/VALIDATION/filename.webp

It would be more convenient to use.

[oldcai]

@DarthSim

I've implemented this feature, I'll pull a request if you have considered it's acceptable.

[DarthSim]

As far as I know frontend, you need to do this replacement before images start to load. To do so, you'll have to put image url to something like data-src instead of src. And if you do so, it's not more complex to generate two URLs, put them to data-src and data-src-webp, and use the one that is best supported by the browser.

Finally, I don't want to break back compatibility for now. So I'm going to close the issue.