14

How do I remove the itok token from the image URLs?

I found an article discussing it, but it only works for Drupal 7 (https://www.drupal.org/node/1934498).

Some articles explains why Drupal adds tokens to the image URLs.

0

2 Answers 2

13

While it's recommended to keep the itok parameter, it is configurable.

You can suppress it from output using the image.settings config setting suppress_itok_output

  // The token query is added even if the
  // 'image.settings:allow_insecure_derivatives' configuration is TRUE, so
  // that the emitted links remain valid if it is changed back to the default
  // FALSE. However, sites which need to prevent the token query from being
  // emitted at all can additionally set the
  // 'image.settings:suppress_itok_output' configuration to TRUE to achieve
  // that (if both are set, the security token will neither be emitted in the
  // image derivative URL nor checked for in
  // \Drupal\image\ImageStyleInterface::deliver()).

https://api.drupal.org/api/drupal/core!modules!image!src!Entity!ImageStyle.php/function/ImageStyle%3A%3AbuildUrl/8.2.x

5
  • 8
    Thanks, i add $config['image.settings']['suppress_itok_output'] = TRUE; to my site's settings.php file and it workd fine.
    – shi jack
    Commented Sep 18, 2016 at 6:18
  • 8
    And another configuration $config['image.settings']['allow_insecure_derivatives'] = TRUE;
    – shi jack
    Commented Sep 19, 2016 at 1:53
  • 1
    Additional Info. if site is accessed from https. make sure to enable "allow_insecure_derivatives" to TRUE as mentioned by shi jack.
    – JayKandari
    Commented Nov 9, 2016 at 14:57
  • @shijack It works for me, but in some other way that is not usable. I set it on configuration and work first time, for the second page is not working, so I disable the configuration and reload the page still not working, again applying the changes and reload the page then it works and show the image. BTW Thanks. Commented Oct 6, 2019 at 5:56
  • Added the examples from @shijack to the answer, thanks! Commented Nov 13, 2019 at 0:28
2

Put this in your settings.php (or local.settings.php):

$config['image.settings']['suppress_itok_output'] = TRUE;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.