We are in the beginning stages of a site and so there is very little custom code introduced at this point. I've noticed that images are not being resized properly.

I originally thought the hash was not being applied properly, but that turned out to not be the case. I've tested this in two ways:

  1. Disabled Media Request Protection
  2. Altered a generated URL

After disabling Media Request Protection, I assumed I could simply alter an image by appending h or w to the query string as such:


However, the image is not resized.

When I leave Media Request Protection turned on and modify a URL, e.g.:


I receive the proper log message:

6720 12:46:46 ERROR MediaRequestProtection: An invalid/missing hash value was encountered. The expected hash value: AE578A561DA323EEC4F7324CB154DBB9BA6B8924. Media URL: /-/media/Home-Page/images/careers-icon.ashx?h=200&mh=10&mw=175&w=175&hash=BAB30E6E5E518F898DFE7D3C726658814B46BA46, Referring URL: (empty)

As you can see, I've also tried setting the max width and max height attributes as well, to no avail. Is this a known bug in our Sitecore version? As stated, this is a pretty vanilla install at this point.

  • If it matters, this is an MVC app and we're using @RenderImage(Model, x => x.Image, isEditable: true) in all cases
    – jrap
    Nov 23, 2016 at 19:06
  • Can you please visit /URL/Sitecore/admin/showconfig.aspx and check out the <getMediaStream> node and make sure there is nothing non-Sitecore in there.
    – Chris Auer
    Nov 24, 2016 at 1:54
  • Also turn off MRP again and add &dmc=1 to your URL to see if you have a caching issue. dmc = 1 turns off media cache.
    – Chris Auer
    Nov 24, 2016 at 1:56

1 Answer 1


The MediaRequestProtection is there for good reason - so I would go out of your way to ensure that it's used (otherwise your site is vulnerable to an attack vector).

The media protection uses the width, height and other properties to calculate the hash (so they're tied to the hash you have) so it's not a surprise that modifying the URL doesn't work. You need to generate the whole URL in code.

RenderImage is Glass I think? You can add width and height etc using the Glass mapper method:

@RenderImage(x=>x.Image, new {w = 50, width=50}, outputHeightWidth:true)

For more details about GlassMapper's parameters see here - if GlassMapper isn't generating your hash - check you're on the latest version and then let the guys at GM know :)

Is there a chance that (with MediaRequestProtection disabled) - the image is already cached on your machine from looking at it with MRP enabled? I would try it without the hash value at all when you're testing with MRP disabled.

By default - the following parameters are protected (so you can't change them without regenerating the hash:

      <parameter description="width" name="w"/>
      <parameter description="height" name="h"/>
      <parameter description="max width" name="mw"/>
      <parameter description="max height" name="mh"/>
      <parameter description="scale" name="sc"/>
      <parameter description="allow stretch" name="as"/>
      <parameter description="background color" name="bc"/>
      <parameter description="database name" name="db"/>
      <parameter description="ignore aspect ratio" name="iar"/>
      <parameter description="language code" name="la"/>
      <parameter description="thumbnail" name="thn"/>
      <parameter description="version number" name="vs"/>
      <parameter description="content database" name="sc_content"/>
      <parameter description="content language name" name="sc_lang"/>
      <parameter description="context site" name="sc_site"/>
      <parameter description="grayscale filter" name="gray"/>

There's some information about how you can generate a new hash on this useful blog post. Notably:

in C# code, you can use HashingUtils.ProtectAssetUrl(url) to get the full media URL with hash included.

  • Thanks for the long response, but none of this is new information unfortunately. Obviously, I want to keep the protection turned on, but turned it off for troubleshooting. Also, in my troubleshooting I tried the media request without the hash parameter and with MRP turned off, and it still returned the default image size (which is massive). I tested on a different system and it worked as expected- when I disabled MRP, I could modify the request with any h/w combo (even if I included the hash) and it resized appropriately. Hopefully your response helps others, but it doesn't assist me.
    – jrap
    Nov 24, 2016 at 1:27
  • Was the different system the same version of Sitecore or a different version? Nov 24, 2016 at 7:41
  • It was not the same version, however I was just able to check with the same version, completely vanilla install and it failed in the same way. I will bring this up with support.
    – jrap
    Nov 28, 2016 at 18:46
  • 2
    Ugh, the image in question I found out was uploaded as SVG, which was not apparent by the .ashx extension. I added a custom media.ashx handler (using reflector) and noticed it. When I tested on the vanilla install, the image was cached when I tried :/. I will mark yours as the answer as it was the best attempt at solving the problem and should help others.
    – jrap
    Nov 28, 2016 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.