HTTP Source

The HTTP source is the default source in PreviewProxy and is always enabled. It allows you to proxy and transform any publicly accessible image over HTTP or HTTPS.

Basic Usage

Include the full image URL (starting with http:// or https://) as the last segment of the request path:

/<params>/<image_url>

Example:

/w=400/https://example.com/photo.jpg

URL Encoding

The image URL in the path is URL-decoded automatically. This means you can percent-encode the URL if needed - for example, when embedding the proxy URL inside another URL or passing it through systems that require encoding:

/w=400/https%3A%2F%2Fexample.com%2Fphoto.jpg

Both the encoded and plain forms are handled correctly.

Configuration

The HTTP source behaviour is controlled by the following environment variables:

Variable	Default	Description
`PP_ALLOWED_HOSTS`	(unset)	Comma-separated list of allowed hostnames. If set, only these hosts may be proxied.
`PP_FETCH_TIMEOUT_SECS`	`10`	Maximum time in seconds to wait for the upstream server to respond.
`PP_MAX_SOURCE_BYTES`	`20971520` (20 MB)	Maximum size of the source image that will be downloaded.

Restricting Allowed Hosts

By default, PreviewProxy will fetch images from any public host. To restrict which domains are permitted, set PP_ALLOWED_HOSTS:

PP_ALLOWED_HOSTS=example.com,assets.mysite.com

Fetch Timeout

If the upstream server takes longer than PP_FETCH_TIMEOUT_SECS to respond, the request will be aborted and an error returned to the client.

PP_FETCH_TIMEOUT_SECS=30

Maximum Source Size

Requests for images exceeding PP_MAX_SOURCE_BYTES will be rejected before the full body is downloaded.

PP_MAX_SOURCE_BYTES=10485760  # 10 MB

Private IP Protection

This prevents server-side request forgery (SSRF) attacks where an attacker could use the proxy to reach internal network services.