I appreciate the 7.20 security measure that requires a itok parameter for generating new images, but I need to expose that to Services / AJAX driven projects.

Can you get the image token programmatically so that JavaScript can build valid image urls for any size dynamically?

I would like to avoid $conf['image_allow_insecure_derivatives'] = TRUE; unless someone has a project to apply this same security measure on a user session level as opposed to per image

1 Answer 1


It should be possible to get the token via a custom ajax callback that returns:

$token_query = array(IMAGE_DERIVATIVE_TOKEN => image_style_path_token($style_name, $original_uri));

From a custom menu router path or services callback.

  • thanks @tenken!, i'll try this now. Do you know how much processing goes into the token generation? Would doing this for a 50 images in a loop be a problem?
    – E.A.T
    Apr 29, 2015 at 23:20
  • 50 images shouldnt be a problem, it's 2015 now .... Now 50000000 images ... Then yes you may have a problem :)
    – tenken
    Apr 29, 2015 at 23:24
  • fair enough. thanks! it all works fine. Q: do you know if the tokens change over time / have a lifetime?
    – E.A.T
    Apr 30, 2015 at 1:11
  • for those of your whom appreciate little details on a same answer's page: tokens are a static hash of the image uri, some config variables, and the style name being generated. it does not change with time, only per image and database.
    – E.A.T
    May 1, 2015 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.