How to stop a request for an external image from exposing my IP to the server hosting the image?

Question

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains:

<img src=https://www.domainD.com/testT.jpg>

Then I have a computer C, that accesses W.

Will computer C directly ask domainD for testT.jpg? Or will it ask A for testT.jpg, and then A asks domainD for testT.jpg and send the data back to C?

From the test result, it's the former case.

If C directly asks for testT.jpg from the server, the server will easily know the IP of C. How can I prevent that?

Answer 1

HTTP is Hyper Text Transfer Protocol. Hyper text stands for the ability to aggregate informations from different sources. If you advertise an URL in a web page, the browser will use that URL to fetch the information piece. This is inherent to the protocol. Full stop here.

But, you can advertive a local URL for a distant resource. That is called reverse proxying. Any good http server should have options for that. In Apache, mod_proxy contains all you could need with the ProxyPass directive:

You can then use:

<img src=/domainD/testT.jpg>

and in Apache config:

<Location "/domainD/">
    ProxyPass "https://www.domainD.com/"
</Location>

Here, the browser will send the request to your own server, because it only sees your local URL, and that server will send a request for the actual resource and send it back to the client browser, hiding the original client IP.

Answer 2

In your example, computer C would directly access domain D, to obtain the image.

As you noted in your question, it's an external resource. This means, your website W has no control over the content on that host. Clients can try to protect themselves, as @Tobi-nary has stated in his answer.

The other option would be to host the resource on the website and therefore completely avoid the interaction with domain D. If this is possible, that would be the best option from my point of view, as you would protect all users and not only those, that are aware of the "risk".

For server side defense @Serge-Ballesta has given the best answer, I assume.

To sum everything up, these would be your options:

1. Self-host the content. (server side)
2. Allow your server to get the content for your users (server side)
3. Use TOR (client side)
4. Use a Proxy (client side)
5. Use a VPN (client side)

Answer 3

There are a couple of ways you can do this, the first and most obvious is a VPN this will however hide your IP from server A.

Another way is to use a plugin on your browser to remove links and external resources such as what you have posted from the page, however, you risk making the site very ugly to look at or losing a lot functionality.

You could build upon a plugin by adding a white and black lists but you are creating a lot of hassle.

VPN would be your best bet in my opinion.

Answer 4

Your browser goes directly on url in given tag to fetch the image.

1. If you control the server you can setup a proxy as suggested by @Serge Ballesta. That way you ask serverA for example on url: https://www.domainA.com/testT.jpg and server handles request to domainD and passes the result back to you.
2. As client you can rent (or use trial credit) some linux machine on the internet and setup the socks proxy. That way all request are comming from socks proxy server IP.

Check out, how to setup socks proxy here: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/

Answer 5

A default browser with direct internet connection will indeed ask the server specified in the src tag.

What you are basically asking is how to anonymize or obfuscate your browsing traffic and there are different options:

1. TOR

   The Onion Router acts as a (SOCKS) proxy, routing your request through different nodes; the server doesn't see the clients IP but the one of the TOR exit node. Using a browser plugin can allow you to white/blacklist certain domains to optionally not use TOR (or a proxy, see 2) for some domains.

2. A Proxy

   The proxys IP will be visible, not the client one. Most providers do keep logs, though. Those would be possible to use for tracing back a request (for example if that request contained illegal content). Depending on your specific setup, DNS requests may still be made by your machine.

3. VPN

   All your traffic will be routed through the VPN provider. The VPN providers IP will be visible on the server. Caveat: Logs of the provider (cf. 2).