I have a web-site with images stored on my own server. Some other web-sites use links to these images on their pages, so the server have to handle extra traffic. Can I forbid loading images and other media for external sites with Nginx config? Maybe CORS settings could help me? Thanks!
1 Answers
CORS cannot help you there, because CORS doesn't apply to image tags that lack a crossorigin attribute. You have two options:
- a cross-origin resource policy, or
- a resource isolation policy.
Cross-origin resource policy
You can specify a cross-origin resource policy (CORP) in the response to requests to your resources. For instance, if you specify the following response header,
Cross-Origin-Resource-Policy: same-site
browsers that support CORP will prevent cross-site origins from embedding your resources in their pages.
Two caveats:
- A CORP won't allow you to save any bandwidth, because all browsers (whether or not they support CORP) will download the whole resource first before deciding whether a page can load it.
- The
Cross-Origin-Resource-Policyresponse header won't have any effect in browsers that don't support CORP; users of those browsers will be able to load your resources regardless of the page's origin.
Resource Isolation Policy
Alternatively, you can implement some resource isolation policy on the server side via Fetch Metadata request headers:
A Resource Isolation Policy prevents your resources from being requested by external websites.
Be aware that only modern versions of Chromium-based browsers and (more recently) Firefox currently send those request headers; Safari notably does not.
However, implementing such a resource isolation policy may be enough to dissuade third parties from embedding your images on their websites, as a large proportion of their visitors won't be able to load your content.
Related