Image Not Being Resized Properly (Sitecore 8.1 rev 160519)

Question

We are in the beginning stages of a site and so there is very little custom code introduced at this point. I've noticed that images are not being resized properly.

I originally thought the hash was not being applied properly, but that turned out to not be the case. I've tested this in two ways:

1. Disabled Media Request Protection
2. Altered a generated URL

After disabling Media Request Protection, I assumed I could simply alter an image by appending h or w to the query string as such:

http://URL/-/media/Home-Page/images/careers-icon.ashx?h=200&mh=175&mw=175&w=175&hash=BAB30E6E5E518F898DFE7D3C726658814B46BA46

However, the image is not resized.

When I leave Media Request Protection turned on and modify a URL, e.g.:

http://URL/-/media/Home-Page/images/careers-icon.ashx?h=200&mh=10&mw=175&w=175&hash=BAB30E6E5E518F898DFE7D3C726658814B46BA46

I receive the proper log message:

6720 12:46:46 ERROR MediaRequestProtection: An invalid/missing hash value was encountered. The expected hash value: AE578A561DA323EEC4F7324CB154DBB9BA6B8924. Media URL: /-/media/Home-Page/images/careers-icon.ashx?h=200&mh=10&mw=175&w=175&hash=BAB30E6E5E518F898DFE7D3C726658814B46BA46, Referring URL: (empty)

As you can see, I've also tried setting the max width and max height attributes as well, to no avail. Is this a known bug in our Sitecore version? As stated, this is a pretty vanilla install at this point.

Answer 1

The MediaRequestProtection is there for good reason - so I would go out of your way to ensure that it's used (otherwise your site is vulnerable to an attack vector).

The media protection uses the width, height and other properties to calculate the hash (so they're tied to the hash you have) so it's not a surprise that modifying the URL doesn't work. You need to generate the whole URL in code.

RenderImage is Glass I think? You can add width and height etc using the Glass mapper method:

@RenderImage(x=>x.Image, new {w = 50, width=50}, outputHeightWidth:true)

For more details about GlassMapper's parameters see here - if GlassMapper isn't generating your hash - check you're on the latest version and then let the guys at GM know :)

Is there a chance that (with MediaRequestProtection disabled) - the image is already cached on your machine from looking at it with MRP enabled? I would try it without the hash value at all when you're testing with MRP disabled.

By default - the following parameters are protected (so you can't change them without regenerating the hash:

    <protectedMediaQueryParameters>
      <parameter description="width" name="w"/>
      <parameter description="height" name="h"/>
      <parameter description="max width" name="mw"/>
      <parameter description="max height" name="mh"/>
      <parameter description="scale" name="sc"/>
      <parameter description="allow stretch" name="as"/>
      <parameter description="background color" name="bc"/>
      <parameter description="database name" name="db"/>
      <parameter description="ignore aspect ratio" name="iar"/>
      <parameter description="language code" name="la"/>
      <parameter description="thumbnail" name="thn"/>
      <parameter description="version number" name="vs"/>
      <parameter description="content database" name="sc_content"/>
      <parameter description="content language name" name="sc_lang"/>
      <parameter description="context site" name="sc_site"/>
      <parameter description="grayscale filter" name="gray"/>
    </protectedMediaQueryParameters>

There's some information about how you can generate a new hash on this useful blog post. Notably:

in C# code, you can use HashingUtils.ProtectAssetUrl(url) to get the full media URL with hash included.