Onebox、favicon 和 Cloudflare 的“热链保护”

支持
1

The following WordPress site is behind Cloudflare, currently with " Scrape Shield", “Hotlink Protection” off:

https://www.thenews.coop/139235/sector/worker-coops/worker-co-op-weekend-2019-restorative-sociable-inspiring-get-together/

When “Hotlink Protection” is on the article image is downloaded by Discourse to display in the onebox but the favicon is not (in Firefox this is clear as there is an empty box):

Screenshot_2019-06-13%20Co-operatives%20UK%20Workers%20Co-op%20Weekend%20May%2010th-12th%202019
Screenshot_2019-06-13 Co-operatives UK Workers Co-op Weekend May 10th-12th 2019.png828×192 38.4 KB

This is the HTML source:

<img src="https://www.thenews.coop/wp-content/uploads/favicon-1.ico" 
     class="site-icon" width="64" height="64">

With “Hotlink Protection” on the favicon is not displayed due to the Cloudflare serving a “Error 1011, Access denied”.

I was also wondering, has the downloading and serving locally, of favicons been considered for cases where Cloudflare’s “Hotlink Protection” is on?

2

How would you do that? And if someone had gone to lengths to see that you can’t download those images my response is either “serves them right” or “I will respect their wishes.”

3

与其他图片的处理方式相同吗？

参考这个 onebox：

篝火图片的 URL 是：

![](upload://yL3c0erBE8QgCGLh5SKlzQJ1nZj.jpeg)

它是 Discourse 从该原始 URL 的网站上下载的：

https://www.thenews.coop/wp-content/uploads/D6eFNECXkAM9BmG-1280x600.jpg

我只是想问，将 favicon 像其他图片一样处理（即下载副本并在本地提供）是否合理？

亲自测试当前行为即可：在 Cloudflare 保护下的网站上启用“热链保护”，你会发现 Discourse 仍然会下载 onebox 的主要图片……

4

They will as long as they are in a format your Discourse accepts. The example in OP is using .ico, which is an old format not allowed in Discourse by default. You can add it to the list in your site.

5

I added .ico to authorized extensions and rebuilt the HTML of a post and while the favicon wasn’t downloaded and served locally straight away it was when I checked it a couple of days later.