如何安全且经济地在我的网站上允许图像？
我开发了一个园丁社交网站网站，并且有兴趣让用户能够将图像添加到他们的“推文”。
如果我允许他们将图像上传到实际网站，这似乎很快就会变得昂贵（这是一个副项目，除了我自己和我自己的痴迷之外，没有任何人资助）。假设该网站变得相当受欢迎，每周有 10 万用户发布一张尺寸仅为 25 万的图像。即 (100000 * .1 * 52 / 1024) = 508 MB/年的存储空间（并且不考虑增加的带宽）。另外，我必须增加服务器负载才能缩放图像。我不确定我是否应该继续这样做，或者是否有更好的可能性。
在某些方面，链接到其他网站似乎更好。您确实有损坏的链接，但对我来说更关心的是安全性：XSS。
该应用程序位于 Rails 3 上，使用 MongoDB / Mongoid 作为后端（如果有的话）。
我正在寻找诸如以下的解决方案：
- 在外部站点上存储图像的 API。理想的情况是能够将其上传到我的网站，并进行 API 调用以将其存储在外部网站上。
- API（可能是 Javascript API）可以轻松安全地链接到一个或多个外部图像托管站点。
- Markdown 或类似的标记，允许安全地链接到外部图像。我感兴趣的是让用户能够以有限的方式格式化他们的帖子，因此这可能会同时解决两个问题。我注意到 Stack Overflow 就是这么做的。
- 将图像 URL 模式列入白名单的安全库
- 关于为什么我错误地思考这个问题的建议。例如，也许我应该只存储图像。一年 500MB 确实不算贵，而且它确实让我能够创造出非常干净的用户体验。
我的目标是（按顺序）： - 安全，既适合我自己的网站，也不允许针对其他网站的 XSS 攻击 - 最佳的用户体验 - 易于维护和实施
您做了什么来允许用户在您的网站上提供图像？
I have developed a social networking site for gardeners website, and am interested in giving users the ability to add images to their "tweets".
If I allow them to upload images to the actual site, it seems like this will quickly become expensive (this is a side project, not funded by anyone than myself and my own obsessions). Let's say the site becomes moderately popular, with 100K users posting one image a week, of only 250K in size. That's (100000 * .1 * 52 / 1024) = 508 MB/year in storage (and that doesn't take into account increased bandwidth). Plus I'd have to increase the server load to scale the images. I'm not sure if I should just go ahead with this, or if there are better possibilities.
Linking to other sites seems better in some ways. You do have broken links, but a larger concern for me is security: XSS.
The application is on Rails 3, using MongoDB / Mongoid as the backend, if that matters.
I'm looking for solutions such as:
- APIs that store images on external sites. What would be ideal is the ability to upload it to my site, and make an API call to store it on an external site.
- APIs (perhaps Javascript APIs) that make it easy to link to one or more external image hosting sites securely.
- Markdown or similar markup that allow linking to external images securely. I am interested in giving users the ability to format their posts in limited ways, so this might solve two problems at the same time. I notice that this is what Stack Overflow does.
- Security libraries that whitelist image URL patterns
- Advice on why I am thinking about this problem wrong. For example, maybe I should just store the images. 500MB a year is really not all that expensive, and it does allow me to create a very clean user experience.
My objectives are (in order):
- Secure, both for my own site, and to not allow XSS attacks against other sites
- Best possible user experience
- Easy to maintain and implement
What have you done to allow user-supplied images on your site?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
你错误地思考了这个问题;)或者说没有在正确的时间思考这个问题。
当您还没有那么多用户时，现在不必担心带宽。首先集中精力使网站变得用户友好且受欢迎。性能、带宽、磁盘空间——这些是当它们出现问题时你需要解决的问题。当您拥有 10 万用户时，购买 Amazon S3 等空间和带宽的成本可能不再是问题。
You're thinking about the problem wrong ;) or rather not at the right time.
Don't worry about the bandwidth now, when you don't have that many users yet. Concentrate on making the site user friendly and popular first. Performance, bandwidth, disk space - these are the things you'll work on when they become problems. By the time you've 100k users the cost of buying that space and bandwidth on, say, Amazon S3 may not be an issue anymore.
为什么不使用像 Amazon s3 这样的服务呢？很便宜，非常便宜（具有减少冗余存储），并且最重要的插件（例如 Paperclip）开箱即用地支持它......
Why not using a service like Amazon s3? Is cheap, very cheap (With the Reduced Redundancy Storage), and the most important plugins like Paperclip support it out of the box...
您需要查看图片主机（flickr 等...）的条款和条件，并查看您的使用情况是否适用。 Flickr 有一个 API，不确定其他的，只需搜索 HOST api。
Flickrs api 位于：
http://www.flickr.com/services/api/
You will need to look at the T&C of picture hosts (flickr etc...) and see if your usage is applicable. Flickr has an API, not sure about the others just search for HOST api.
Flickrs api is at:
http://www.flickr.com/services/api/