An image proxy fetches a permitted remote image, verifies the response and re-encodes it before serving it. It must treat the remote address as untrusted input.
What It Does
An allowlist must be enforced before any outgoing request. Cap both compressed bytes and decoded pixel count before allocation.
Requirements and Compatibility
Use a supported PHP runtime and install any third-party tool or extension explicitly shown in the examples. Commands should be run from the project root unless stated otherwise.
Syntax, Inputs and Results
The examples separate configuration, the smallest working operation and a realistic follow-up task. Adapt file paths and dependency versions to your own project.
Example 1: Basic Use
An allowlist must be enforced before any outgoing request.
<?php
$allowedHosts = ['static.example.test'];
$url = 'https://static.example.test/products/42.jpg';
$host = parse_url($url, PHP_URL_HOST);
if (!in_array(strtolower((string) $host), $allowedHosts, true)) {
throw new InvalidArgumentException('Unsupported origin');
}Example 2: Another Case
Cap both compressed bytes and decoded pixel count before allocation.
<?php
$bytes = file_get_contents(__DIR__ . '/sample.png');
if (strlen($bytes) > 2_000_000) throw new RuntimeException('Image too large');
$size = getimagesizefromstring($bytes);
if ($size === false || $size[0] * $size[1] > 8_000_000) {
throw new RuntimeException('Invalid or oversized image');
}Practical Example
Re-encode decoded pixels rather than returning untrusted source bytes.
<?php
$bytes = file_get_contents(__DIR__ . '/sample.png');
$decoded = imagecreatefromstring($bytes);
if (!$decoded instanceof GdImage) throw new RuntimeException('Decode failed');
header('Content-Type: image/png');
imagepng($decoded);For production, apply the compatibility and edge-case limits described below.
Important Behavior and Edge Cases
Use fixed trusted upstream hosts, block redirects and private IP destinations, enforce byte and pixel budgets, and validate actual decoded image content. The snippets illustrate components, not a complete SSRF-safe proxy.
Comparison with Related Functions and Tools
| Subject | Key difference |
|---|---|
| GD vs Imagick | GD is a lightweight pixel API; Imagick depends on ImageMagick and supports other transformations and formats. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Trusting upload MIME declarations alone | Decode the file with an approved decoder and cap bytes and pixel dimensions. |
| Skipping the prerequisite of this specific workflow | Install or configure the named tool and confirm the example can actually run. |
| Ignoring edge conditions | Use fixed trusted upstream hosts, block redirects and private IP destinations, enforce byte and pixel budgets, and validate actual decoded image content. The snippets illustrate components, not a complete SSRF-safe proxy. |
Key Takeaways
- An image proxy fetches a permitted remote image, verifies the response and re-encodes it before serving it. It must treat the remote address as untrusted input.
- Use fixed trusted upstream hosts, block redirects and private IP destinations, enforce byte and pixel budgets, and validate actual decoded image content. The snippets illustrate components, not a complete SSRF-safe proxy.
- Keep application configuration, source code and validation tests under version control.
Use these examples as a starting point, then validate the result with the actual PHP build, dependencies and inputs used by your application.