Solutions for Sina Image Hosting Failure

Foreword

Recently, Sina Cloud added Referer anti-hotlinking verification to its image hosting service, which broke the referenced images in many bloggers' articles that use Sina as their image host, so they can no longer be displayed. To work around this, we can bypass the Referer anti-hotlinking check through relaying or spoofing.

What is Referer anti-hotlinking

The HTTP Referer is part of the header. When a browser sends a request to a web server, it usually includes the Referer, telling the server which page the request was linked from. The server can use this information for processing. For example, if you link to a friend's site from your homepage, your friend's server can count from the HTTP Referer how many users click the link on your homepage each day to visit their site.

Based on the Referer, the server side can tell which requests come from "allies" and which come from external links, thereby filtering requests and saving server resources.

Our solution is to access resources without sending a Referer, so we need to disguise or relay the request. Without further ado, here are the solutions.

Solutions

PHP File Relay

<?php
header('Content-type: image/jpeg');
echo file_get_contents(isset($_GET["url"])?$_GET["url"]:'');

Principle: Pass in the URL and then output the image to display it.

Pros and cons: Statistics components can be used, but efficiency is low, and it requires replacing links in bulk.

Usage: Create a PHP file on a server.

http(s)://your-domain/img.php?url=image-address

Example:

<img src="https://your-domain-name/img.php?url=https://ws3.sinaimg.cn/large/006tNbRwly1fyq4yujgssj30jg0jgmxg.jpg" />   

(Verified to work)

Using iframe

<script>window.sc="<img src='图片链接?"+Math.random()+"'>";</script>  
<iframe id="imiframe" src="javascript:parent.sc" style="border:none; overflow: hidden;" scrolling="no" frameborder="0" onload="javascript:var x=document.getElementById('imiframe').contentWindow.document.images[0];this.width=x.width+10;this.height=x.height+10;"></iframe>  

Principle: Reference through an iframe.

Pros and cons: Slow, meh.

(Not verified)

Curl

<?php  
$url = $_GET["url"];  
$dir = pathinfo($url);  
$host = $dir['dirname'];  
$refer = $host.'/';  
  
$ch = curl_init($url);  
curl_setopt ($ch, CURLOPT_REFERER, $refer);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);//激活可修改页面,Activation can modify the page  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
curl_setopt($ch, CURLOPT_BINARYTRANSFER, 1);  
$data = curl_exec($ch);  
curl_close($ch);  
  
$ext = strtolower(substr(strrchr($img,'.'),1,10));  
$types = array(  
            'gif'=>'image/gif',  
            'jpeg'=>'image/jpeg',  
            'jpg'=>'image/jpeg',  
            'jpe'=>'image/jpeg',  
            'png'=>'image/png',  
);  
$type = $types[$ext] ? $types[$ext] : 'image/jpeg';  
header("Content-type: ".$type);  
echo $data;   

Principle: Do not send the Referer.

Pros and cons: Statistics components can be used, but slow, and it requires replacing links in bulk.

Usage: Create a PHP file on a server.

http(s)://your-domain/img.php?url=image-address

Example:

<img src="https://your-domain-name/img.php?url=https://ws3.sinaimg.cn/large/006tNbRwly1fyq4yujgssj30jg0jgmxg.jpg" />   

(Verified to work)

Meta Tag

<meta name="referrer" content="never">

Principle: Do not send the Referer by specifying a meta tag with name set to referrer.

Pros and cons: Statistics components cannot be used, because statistics also rely on this mechanism.

(Not verified)

CSP Response Header

<meta http-equiv="Content-Security-Policy" content="referrer">

Principle: CSP (Content Security Policy) is a specification related to page content security. Over HTTP, the Content-Security-Policy field in the response header tells the browser which CSP policy the current page should use.

(Not verified)

Referer Attribute on <a> Tags

<a href="https://www.xsy.fun" referrer="no-referrer">XSY的FUN天地</a>

Principle: Add a no-referrer policy to the <a> tag.

Pros and cons: This method only affects this single link.

In addition, only three Referrer policies are available for <a> tags: no-referrer, origin, and unsafe-url.

Also, a policy set on an individual link takes precedence over CSP.

Emmm

The best approach is to build your own image host or use object storage.

I recommend Alibaba Cloud OSS: low cost and fast, and it supports global acceleration via CDN (charged separately).

Cloud product universal red envelope: click here

Also, migration solutions have already been shared by experts.

See GitHub: link