Skip to content

[Images] Feedback from original PR #19798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 6, 2025
Merged

[Images] Feedback from original PR #19798

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/content/docs/images/get-started.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ You can dynamically optimize images that are stored outside of Cloudflare Images

Cloudflare will automatically cache every transformed image on our global network so that you store only the original image at your origin.

To enable this functionality on your zone:
To enable transformations on your zone:

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
2. Go to **Images** > **Transformations**.
Expand Down
18 changes: 9 additions & 9 deletions src/content/docs/images/transform-images/sources.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@ sidebar:

When optimizing remote images, you can specify which origins can be used as the source for transformed images. By default, Cloudflare accepts only source images from the zone where your transformations are served.

You will learn how to define and manage the origins for the source images that you want to optimize.
On this page, you will learn how to define and manage the origins for the source images that you want to optimize.

:::note
This setting applies to requests from Cloudflare Workers.
The allowed origins setting applies to requests from Cloudflare Workers.

If you use a Worker to optimize remote images via a `fetch()` subrequest, then this setting may conflict with existing logic that handles source images.
:::
Expand All @@ -31,7 +31,7 @@ You can restrict source images to **allowed origins**, which applies transformat

By default, your accepted sources are set to **allowed origins**. Cloudflare will always allow source images from the same zone where your transformations are served.

If you request a transformation with a source image from outside your **allowed origins**, then the image will be rejected. For example, if you serve transformations on your zone `a.com` and do not define any additional origins, then `a.com/image.png` can be used as a source image, but b.com/image.png will return an error.
If you request a transformation with a source image from outside your **allowed origins**, then the image will be rejected. For example, if you serve transformations on your zone `a.com` and do not define any additional origins, then `a.com/image.png` can be used as a source image, but `b.com/image.png` will return an error.

To define a new origin:

Expand All @@ -40,17 +40,17 @@ To define a new origin:

![Add the origin for source images in the Cloudflare dashboard](~/assets/images/images/add-origin.png)

When you add a root domain, subdomains are not accepted. In other words, if you add `b.com`, then source images from media.b.com will be rejected.
When you add a root domain, subdomains are not accepted. In other words, if you add `b.com`, then source images from `media.b.com` will be rejected.

To support individual subdomains, you can define an additional origin such as `media.b.com`. If you add only `media.b.com` and not the root domain, then source images from the root domain (`b.com`) and other subdomains (`cdn.b.com`) will be rejected.
To support individual subdomains, define an additional origin such as `media.b.com`. If you add only `media.b.com` and not the root domain, then source images from the root domain (`b.com`) and other subdomains (`cdn.b.com`) will be rejected.

To support all subdomains, you can use the `*` wildcard at the beginning of the root domain. For example, `*.b.com` will accept source images from the root domain (like `b.com/image.png`) as well as from subdomains (like `media.b.com/image.png` or `cdn.b.com/image.png`).
To support all subdomains, use the `*` wildcard at the beginning of the root domain. For example, `*.b.com` will accept source images from the root domain (like `b.com/image.png`) as well as from subdomains (like `media.b.com/image.png` or `cdn.b.com/image.png`).

3. Optionally, specify the **Path** for the source image. If no path is specified, then source images from all paths on this domain are accepted.
3. Optionally, you can specify the **Path** for the source image. If no path is specified, then source images from all paths on this domain are accepted.

Cloudflare checks whether the defined path is at the beginning of the source path. If the defined path is not present at the beginning of the path, then the source image will be rejected.

For example, if you define an origin with domain `b.com` and path `/themes`, then `b.com/themes/image.png` will be accepted but `b.com/media/themes/image.pn`g will be rejected.
For example, if you define an origin with domain `b.com` and path `/themes`, then `b.com/themes/image.png` will be accepted but `b.com/media/themes/image.png` will be rejected.

4. Select **Add**. Your origin will now appear in your list of allowed origins.
5. Select **Save**. These changes will take effect immediately.
Expand All @@ -63,4 +63,4 @@ If you change your accepted sources to **any origin**, then your list of sources

When your accepted sources are set to **any origin**, any publicly available image can be used as the source image for transformations on this zone.

This setting is less secure and may allow third parties to serve transformations on your zone.
**Any origin** is less secure and may allow third parties to serve transformations on your zone.