How do I remove the itok token from the image URLs?

Question

How do I remove the itok token from the image URLs?

I found an article discussing it, but it only works for Drupal 7 (https://www.drupal.org/node/1934498).

Some articles explains why Drupal adds tokens to the image URLs.

• http://www.unimitysolutions.com/blog/image-style-token-itok-drupal

• Why is Drupal adding token on image url

Answer 1

While it's recommended to keep the itok parameter, it is configurable.

You can suppress it from output using the image.settings config setting suppress_itok_output

  // The token query is added even if the
  // 'image.settings:allow_insecure_derivatives' configuration is TRUE, so
  // that the emitted links remain valid if it is changed back to the default
  // FALSE. However, sites which need to prevent the token query from being
  // emitted at all can additionally set the
  // 'image.settings:suppress_itok_output' configuration to TRUE to achieve
  // that (if both are set, the security token will neither be emitted in the
  // image derivative URL nor checked for in
  // \Drupal\image\ImageStyleInterface::deliver()).

https://api.drupal.org/api/drupal/core!modules!image!src!Entity!ImageStyle.php/function/ImageStyle%3A%3AbuildUrl/8.2.x

Answer 2

Put this in your settings.php (or local.settings.php):

$config['image.settings']['suppress_itok_output'] = TRUE;