# Is it possible to "hotlink" SSO avatars?

**URL:** https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232
**Category:** SSO
**Created:** [May 14, 2016, 10:44am UTC](https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232 "2016-05-14T10:44:22Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Nuck](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nuck/32/121732_2.png) [@Nuck](https://meta.discourse.org/u/Nuck)
#### Post date: [May 14, 2016, 10:44am UTC](https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232/1 "2016-05-14T10:44:22Z")

</div>

So, SSO allows overriding avatars, but if I’m not mistaken it just downloads the avatar image and stores them in the Discourse system.

Is it possible to actually allow _overriding_ the URL, maybe providing a set of multiple prescaled images? I’m storing them on S3 with a Varnish cache in front, so it reduces my caching effectiveness and more or less doubles the costs to have two sets of avatars.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 14, 2016, 6:59pm UTC](https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232/2 "2016-05-14T18:59:02Z")

</div>

You can specify a set of fixed randomly chosen avatars for new users in site settings, not sure if that is exactly what you are asking for.

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [May 14, 2016, 7:02pm UTC](https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232/3 "2016-05-14T19:02:40Z")

</div>

If you avatars are in a path like [https://example.com/avatar/username](https://example.com/avatar/username) it’s possible in a site setting.

---

<div class="post-metadata">

### Author: ![Nuck](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nuck/32/121732_2.png) [@Nuck](https://meta.discourse.org/u/Nuck)
#### Post date: [May 14, 2016, 10:35pm UTC](https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232/4 "2016-05-14T22:35:11Z")

</div>

> [@codinghorror](#):
>
> You can specify a set of fixed randomly chosen avatars for new users in site settings, not sure if that is exactly what you are asking for.

I’m asking for the SSO Avatar URL not to be mirrored by Discourse, but just directly rendered onto the page.

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [May 21, 2016, 6:59am UTC](https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232/5 "2016-05-21T06:59:58Z")

</div>

You can also use the external system avatar functionality.

> <https://github.com/discourse/discourse/blob/74b3807f60fb63bb02230f2722fbfb984cde7327/app/models/user.rb#L523-L527>

`color` becomes a rudimentary hash of the username, so just plug this in for the site setting:

```
https://yoursite.com/avatar/discourse?h={color}

```

(this will not work for hosted Discourses, interestingly, as that setting is set as a global override at the current time)

---

<div class="post-metadata">

### Author: ![Nuck](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nuck/32/121732_2.png) [@Nuck](https://meta.discourse.org/u/Nuck)
#### Post date: [May 28, 2016, 4:51pm UTC](https://meta.discourse.org/t/is-it-possible-to-hotlink-sso-avatars/44232/6 "2016-05-28T16:51:12Z")

</div>

> [@riking](#):
>
> You can also use the external system avatar functionality

To do this would require a redirect for each avatar, which seems rather messy. It’d be nice if I could use `external_id` in there, then I could generate the actual URLs
