# Add setting to disable hotlinking of large image files
**URL:** https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909
**Category:** Feature
**Created:** [11 באוגוסט, 2017, 9:47pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909 "2017-08-11T21:47:31Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Nathan\_Dean](https://meta.discourse.org/u/Nathan_Dean)
#### Post date: [11 באוגוסט, 2017, 9:47pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/1 "2017-08-11T21:47:32Z")
We just enabled HTTPS on our discourse instance, but are receiving mixed content warnings because a few of the images posted on our forum have http:// URLs.
Checking the box for setting `download remote images to local` fixes this for 90% of images by uploading the images to the discourse CDN and serving them up over HTTPS. However, if the image is larger than the setting for `max image size kb`, it gets embedded in the page directly by hotlinking, resulting in mixed content warnings, and our site loses the ‘padlock’ image that users associate with HTTPS.
I would like a setting that disables hotlinking of images that are larger than `max image size kb`. This would fix our mixed content use case, but it would also be useful for people browsing discourse who don’t have a lot of bandwidth. They could open up the images in a new tab, but the images would not load by default.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [11 באוגוסט, 2017, 9:50pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/2 "2017-08-11T21:50:05Z")
Adding a #pr-welcome to this, I would like to see mockups though before anyone picks this up.
It is not critical to “remove hotlink right away” instead this can be somewhat delayed until the pull hotlinked images job runs.
Also adding a #planned in cause we want this done for 1.10.
@vinothkannans if you feel like giving this a shot we can sponsor.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [12 באוגוסט, 2017, 8:28am UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/3 "2017-08-12T08:28:36Z")
Yes I can do it. Now I have to create the mockups first, right?
> [@sam](#):
>
> somewhat delayed until the pull hotlinked images job runs.
Is it like displaying placeholder image or raw URL until the image download job is done?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [12 באוגוסט, 2017, 11:55am UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/4 "2017-08-12T11:55:11Z")
Yes something like that, if image is too big add a placeholder
Also we need to handle the case where people hotlink a broken HTTP image while there, we should simply strip it for that case
---
### Author:  [@Overgrow](https://meta.discourse.org/u/Overgrow)
#### Post date: [12 באוגוסט, 2017, 5:43pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/5 "2017-08-12T17:43:40Z")
I’d like to ask whether Discourse uses MIME type or file extension to detect images for hotlinking?
For me it would make much better sense to use MIME as I’ve seen my members sometimes link images that are missing extension completely.
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [12 באוגוסט, 2017, 7:45pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/6 "2017-08-12T19:45:43Z")
The oneboxer does a HEAD and/or GET, so it should have the MIME type at hand. I don’t know what it uses to decide if something gets turned into an image automatically. I just put a copy of my user icon into a file called “toy.car” and made the server return image/jpeg MIME-type for it, but it won’t display in the preview pane as an image.
```plaintext
64.71.168.196 - - [12/Aug/2017:15:31:39 -0400] "HEAD /tmp/toy.car HTTP/1.1" 200 3281 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
64.71.168.196 - - [12/Aug/2017:15:31:39 -0400] "GET /tmp/toy.car HTTP/1.1" 200 7202 "-" "Discourse Forum Onebox v1.9.0.beta5"
```
My browser is Firefox on Linux, so the user-agent in the HEAD is not copying mine.
---
### Author:  [@Overgrow](https://meta.discourse.org/u/Overgrow)
#### Post date: [12 באוגוסט, 2017, 8:04pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/7 "2017-08-12T20:04:39Z")
Exactly that is what I saw.. I’d love when user puts URL of image on line by itself, it gets automatically turned into img tag and image hotlinked..
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [13 באוגוסט, 2017, 9:32am UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/8 "2017-08-13T09:32:06Z")
Pretty sure we only use the file extension.
---
### Author:  [@Overgrow](https://meta.discourse.org/u/Overgrow)
#### Post date: [13 באוגוסט, 2017, 10:11am UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/9 "2017-08-13T10:11:31Z")
Thanks for confirming.
I had to modify manually some links that users posted manually to add img tag around them.
It would be much better if Discourse could use MIME type.
Is there anyone else that agrees?
Can you suggest how hard it would be?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [13 באוגוסט, 2017, 1:25pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/10 "2017-08-13T13:25:03Z")
Please open a seperate topic with broken examples.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [14 באוגוסט, 2017, 4:32pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/11 "2017-08-14T16:32:32Z")
When the HTTP images should be replaced with placeholder image? Once the post is created or when the download job somehow failed?
External images will not be replaced with local images in the below situations .
1. Unable to download the external image (may be file not found).
2. External image is bigger than maximum image size allowed.
3. Error while moving downloaded `temp` file to local storage.
4. Other unknown reasons.
May I use placeholder image for all the above cases? Or broken HTTP images should be stripped completely as you told?
What about HTTPS images? In above cases those also should replaced with placeholder or not?
Can I link placeholder image to original image? So users can see the original image by clicking it.
Any suggestion for default placeholder image? Yes it will have SiteSetting to change.
Sorry for too many questions. I just want to clarify 🙂.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [14 באוגוסט, 2017, 7:45pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/12 "2017-08-14T19:45:40Z")
No probs let me answer:
For (1) add a _special_ placeholder for “broken image”
For (2) add a different general placeholder for large image
For (3) and unknown, I am fine with “undefined” behavior. In fact I would crash the image post processor for local errors and make sure there is an error in logs.
HTTPS images should also be replaced with placeholder if too big.
Keep in mind, for now, this is **optional default off** behavior. Only add “too big” placeholders IF `replace large images with placeholders` is on.
No idea about the placeholder images, just make sure whatever you pick is easily licensable. There may be a font awesome icon you can use, I would try that first.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [14 באוגוסט, 2017, 8:20pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/13 "2017-08-14T20:20:10Z")
The placeholder image should explain what is happening.. image in text kind of thing.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [15 באוגוסט, 2017, 3:18pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/14 "2017-08-15T15:18:44Z")
Do you mean text in image? If yes, then what about translations?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [15 באוגוסט, 2017, 3:23pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/15 "2017-08-15T15:23:06Z")
Can you dig through font-awesome and suggest a couple of glyphs here?
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [15 באוגוסט, 2017, 3:35pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/16 "2017-08-15T15:35:55Z")
### Image file
[](http://fontawesome.io/icon/file-image-o)
### Picture
[](http://fontawesome.io/icon/picture-o)
### Broken chain
[](http://fontawesome.io/icon/chain-broken)
I think above images are related our need.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [15 באוגוסט, 2017, 3:37pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/17 "2017-08-15T15:37:07Z")
I wonder if you can overlay broken chain on picture or something along those lines for missing image.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [15 באוגוסט, 2017, 3:40pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/18 "2017-08-15T15:40:10Z")
Yes. we can do it using javascript.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [15 באוגוסט, 2017, 4:08pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/19 "2017-08-15T16:08:23Z")
> [@vinothkannans](#):
>
> Yes. we can do it using javascript.
I think you can do it in straight CSS, you render them side by side and then just adjust positioning. Try a few out.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [15 באוגוסט, 2017, 4:14pm UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/20 "2017-08-15T16:14:36Z")
okay. I will do 👍
[Next page](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909.md?page=2)