HTTP Source

The HTTP source is the default source in PreviewProxy and is always enabled. It allows you to proxy and transform any publicly accessible image over HTTP or HTTPS.

Basic Usage​

Include the full image URL (starting with http:// or https://) as the last segment of the request path:

/<params>/<image_url>

Example:

/w=400/https://example.com/photo.jpg

URL Encoding​

The image URL in the path is URL-decoded automatically. This means you can percent-encode the URL if needed - for example, when embedding the proxy URL inside another URL or passing it through systems that require encoding:

/w=400/https%3A%2F%2Fexample.com%2Fphoto.jpg

Both the encoded and plain forms are handled correctly.

Configuration​

The HTTP source behaviour is controlled by the following environment variables:

Restricting Allowed Hosts​

By default, PreviewProxy will fetch images from any public host. To restrict which domains are permitted, set ALLOWED_HOSTS:

ALLOWED_HOSTS=example.com,assets.mysite.com

Fetch Timeout​

If the upstream server takes longer than FETCH_TIMEOUT_SECS to respond, the request will be aborted and an error returned to the client.

FETCH_TIMEOUT_SECS=30

Maximum Source Size​

Requests for images exceeding MAX_SOURCE_BYTES will be rejected before the full body is downloaded.

MAX_SOURCE_BYTES=10485760  # 10 MB

Private IP Protection​

This prevents server-side request forgery (SSRF) attacks where an attacker could use the proxy to reach internal network services.