Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/707166536436424705
deleted 157 characters in body; edited tags
Source Link
tim
tim
  • 29.8k
  • 8
  • 98
  • 123

Not sure if this is really the forum for this, but I didn't see a clearly better one, so I'm asking it here. (If it's not, please redirect me to the correct one)

As we all know, many forums allow users to set profile pictures, post images, or put images in signatures. Could

Could a user create an imgimg tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture? 

Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?

Not sure if this is really the forum for this, but I didn't see a clearly better one, so I'm asking it here. (If it's not, please redirect me to the correct one)

As we all know, many forums allow users to set profile pictures, post images, or put images in signatures. Could a user create an img tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture? Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?

As we all know, many forums allow users to set profile pictures, post images, or put images in signatures.

Could a user create an img tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture? 

Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?

Source Link
Stoud
Stoud
  • 344
  • 1
  • 11

Exposing IP address via img tags

Not sure if this is really the forum for this, but I didn't see a clearly better one, so I'm asking it here. (If it's not, please redirect me to the correct one)

As we all know, many forums allow users to set profile pictures, post images, or put images in signatures. Could a user create an img tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture? Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?