16. Image Resize Validation

Resizing Images in the Gentics Portal.Node Server consumes processing time. Therefore, unsecured requests to resize images may open the Server for DoS attacks. With the Image Resize Validation feature, the “GenticsImageStore” (Section 15), “GenticsContentPortlet” (Section 5) and “GenticsContentModule” (Section 4) will no longer accept requests to resize images, unless they contain a certain checksum as validation request parameter.

The Feature is activated by setting the parameter secret (as pnode parameter for the portlets or init-param for the servlet) to a non-empty String value. Once activated, all requests to resized images must be validated by adding the request parameter validation. The parameter must be constructed as SHA256([secret][resizepath]) encoded with two-digit hexcode (leading zeros). Where [resizepath] is the path containing the resize properties:

Example 3.26. Validating Image Resize Requests

Request to /GenticsImageStore/100/auto/prop/images/image.png
must be validated with
SHA256([secret]/100/auto/prop)
e.g. (with "secret" as the secret):
/GenticsImageStore/100/auto/prop/images/image.png?validation=55364166F44A14AC9AE70E86C600A30BB7A8044F59C56D9426BA495D579495CF
				
Request to /GenticsImageStore/auto/200/cropandresize/smart/10/10/100/100/images/image.png
must be validated with
SHA256([secret]/auto/200/cropandresize/smart/10/10/100/100)
e.g. (with "secret" as the secret):
/GenticsImageStore/auto/200/cropandresize/smart/10/10/100/100/images/image.png?validation=3B9C74C7FE34F5C18DA640D897A60193FC2CC4704B3C9CC252594483C030706D
				
Request to /Portal.Node/portal?gentics.rs=content&gentics.rsid=10008.1&maxwidth=100
must be validated with
SHA256([secret]/100/auto/prop)
e.g. (with "secret" as the secret):
/Portal.Node/portal?gentics.rs=content&gentics.rsid=10008.1&maxwidth=100&validation=55364166F44A14AC9AE70E86C600A30BB7A8044F59C56D9426BA495D579495CF
				

Unvalidated or incorrectly validated requests will get a response with status 403 (Forbidden).

[Note]Note
The GenticsContentPortlet an GenticsContentModule will always use prop as resize mode. If either maxwidth or maxheight is not given, the value auto is assumed.