Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this community
First things first, I don't need a DDoS prevention mechanism in Drupal since that is my server's job.
In all my Drupal installs, I usually hide the identity of Drupal for security reasons. Image style token (itok) is also a Drupal identifier. I tried a hack to remove itok in 7.22, and found out itok is not a small implementation, which may need more work to get benefit from the community after hack.
I'm just wondering if there is a better way.
No need to hack, just add the following line to your settings.php file:
$conf['image_allow_insecure_derivatives'] = TRUE;
That will stop the itok parameter from being used.
It's even been wrapped in a module if you don't fancy editing settings.php.
Image Allow Insecure Derivatives
Provides a user interface to allow Drupal to bypass the token security check when generating image derivatives.
As a side note, trying to hide your site's identity as being a 'Drupal' site is pointless. It's known in the field as 'Security through Obscurity', and it's a waste of resources that could be spent solving real security or performance issues.
See How can I obscure what I am using to run my site? for a more in-depth explanation.
This problem is in the queue already. Good thing, it's marked critical. Bad thing, it got moved from 7.x to 8.x (with "needs backport" tag but anyway).
Between 7.19 there were many small, beneficial changes. If you can, just hack out itok and upgrade. And if you can make itok configurable, post your patch to the Issue queue I linked.
As far as I can tell $conf['image_allow_insecure_derivatives'] = TRUE; doesn't work. At least not on versions 7.26+
So yes, a hack seems like the solution. This worked for me: https://drupal.org/node/1934498
Using ImageMagick instead for GD solves the issue.
