1

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains:

<img src=https://www.domainD.com/testT.jpg>

Then I have a computer C, that accesses W.

Will computer C directly ask domainD for testT.jpg? Or will it ask A for testT.jpg, and then A asks domainD for testT.jpg and send the data back to C?

From the test result, it's the former case.

If C directly asks for testT.jpg from the server, the server will easily know the IP of C. How can I prevent that?

  • 1
    When you ask "How can I prevent that?" are you asking from the perspective of the user of computer C, or ther owner of website W? – Anders Feb 12 at 11:40
1

HTTP is Hyper Text Transfer Protocol. Hyper text stands for the ability to aggregate informations from different sources. If you advertise an URL in a web page, the browser will use that URL to fetch the information piece. This is inherent to the protocol. Full stop here.

But, you can advertive a local URL for a distant resource. That is called reverse proxying. Any good http server should have options for that. In Apache, mod_proxy contains all you could need with the ProxyPass directive:

You can then use:

<img src=/domainD/testT.jpg>

and in Apache config:

<Location "/domainD/">
    ProxyPass "https://www.domainD.com/"
</Location>

Here, the browser will send the request to your own server, because it only sees your local URL, and that server will send a request for the actual resource and send it back to the client browser, hiding the original client IP.

  • I'm not sure OP is asking for the server side of things. I added an answer for the client side of things to improve on the answers focusing on that side but were insufficient. – Tobi Nary Feb 12 at 10:26
1

In your example, computer C would directly access domain D, to obtain the image.

As you noted in your question, it's an external resource. This means, your website W has no control over the content on that host. Clients can try to protect themselves, as @Tobi-nary has stated in his answer.

The other option would be to host the resource on the website and therefore completely avoid the interaction with domain D. If this is possible, that would be the best option from my point of view, as you would protect all users and not only those, that are aware of the "risk".

For server side defense @Serge-Ballesta has given the best answer, I assume.

To sum everything up, these would be your options:

  1. Self-host the content. (server side)
  2. Allow your server to get the content for your users (server side)
  3. Use TOR (client side)
  4. Use a Proxy (client side)
  5. Use a VPN (client side)
0

There are a couple of ways you can do this, the first and most obvious is a VPN this will however hide your IP from server A.

Another way is to use a plugin on your browser to remove links and external resources such as what you have posted from the page, however, you risk making the site very ugly to look at or losing a lot functionality.

You could build upon a plugin by adding a white and black lists but you are creating a lot of hassle.

VPN would be your best bet in my opinion.

0

Your browser goes directly on url in given tag to fetch the image.

  1. If you control the server you can setup a proxy as suggested by @Serge Ballesta. That way you ask serverA for example on url: https://www.domainA.com/testT.jpg and server handles request to domainD and passes the result back to you.
  2. As client you can rent (or use trial credit) some linux machine on the internet and setup the socks proxy. That way all request are comming from socks proxy server IP.

Check out, how to setup socks proxy here: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/

0

A default browser with direct internet connection will indeed ask the server specified in the src tag.

What you are basically asking is how to anonymize or obfuscate your browsing traffic and there are different options:

  1. TOR

    The Onion Router acts as a (SOCKS) proxy, routing your request through different nodes; the server doesn't see the clients IP but the one of the TOR exit node. Using a browser plugin can allow you to white/blacklist certain domains to optionally not use TOR (or a proxy, see 2) for some domains.

  2. A Proxy

    The proxys IP will be visible, not the client one. Most providers do keep logs, though. Those would be possible to use for tracing back a request (for example if that request contained illegal content). Depending on your specific setup, DNS requests may still be made by your machine.

  3. VPN

    All your traffic will be routed through the VPN provider. The VPN providers IP will be visible on the server. Caveat: Logs of the provider (cf. 2).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.