2021-01-29 00:20:46 +05:30
---
stage: none
group: unassigned
2021-02-22 17:27:13 +05:30
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
2021-01-29 00:20:46 +05:30
---
2019-12-04 20:38:33 +05:30
# Proxying assets
2019-09-04 21:01:54 +05:30
A possible security concern when managing a public facing GitLab instance is
the ability to steal a users IP address by referencing images in issues, comments, etc.
For example, adding `` to
2021-02-22 17:27:13 +05:30
an issue description causes the image to be loaded from the external
2019-12-04 20:38:33 +05:30
server in order to be displayed. However, this also allows the external server
2019-09-04 21:01:54 +05:30
to log the IP address of the user.
One way to mitigate this is by proxying any external images to a server you
2019-12-04 20:38:33 +05:30
control.
2019-12-21 20:55:43 +05:30
GitLab can be configured to use an asset proxy server when requesting external images/videos/audio in
2019-12-04 20:38:33 +05:30
issues, comments, etc. This helps ensure that malicious images do not expose the user's IP address
when they are fetched.
We currently recommend using [cactus/go-camo ](https://github.com/cactus/go-camo#how-it-works )
2019-12-21 20:55:43 +05:30
as it supports proxying video, audio, and is more configurable.
2019-12-04 20:38:33 +05:30
## Installing Camo server
A Camo server is used to act as the proxy.
To install a Camo server as an asset proxy:
1. Deploy a `go-camo` server. Helpful instructions can be found in
2021-01-03 14:25:43 +05:30
[building cactus/go-camo ](https://github.com/cactus/go-camo#building ).
2019-12-04 20:38:33 +05:30
1. Make sure your instance of GitLab is running, and that you have created a private API token.
Using the API, configure the asset proxy settings on your GitLab instance. For example:
2020-03-13 15:44:24 +05:30
```shell
curl --request "PUT" "https://gitlab.example.com/api/v4/application/settings?\
asset_proxy_enabled=true& \
asset_proxy_url=https://proxy.gitlab.example.com& \
asset_proxy_secret_key=< somekey > " \
--header 'PRIVATE-TOKEN: < my_private_token > '
```
The following settings are supported:
| Attribute | Description |
|:-------------------------|:-------------------------------------------------------------------------------------------------------------------------------------|
| `asset_proxy_enabled` | Enable proxying of assets. If enabled, requires: `asset_proxy_url` ). |
| `asset_proxy_secret_key` | Shared secret with the asset proxy server. |
| `asset_proxy_url` | URL of the asset proxy server. |
2021-03-11 19:13:27 +05:30
| `asset_proxy_whitelist` | (Deprecated: Use `asset_proxy_allowlist` instead) Assets that match these domain(s) are NOT proxied. Wildcards allowed. Your GitLab installation URL is automatically allowed. |
| `asset_proxy_allowlist` | Assets that match these domain(s) are NOT proxied. Wildcards allowed. Your GitLab installation URL is automatically allowed. |
2019-12-04 20:38:33 +05:30
1. Restart the server for the changes to take effect. Each time you change any values for the asset
proxy, you need to restart the server.
## Using the Camo server
2019-12-21 20:55:43 +05:30
Once the Camo server is running and you've enabled the GitLab settings, any image, video, or audio that
2021-02-22 17:27:13 +05:30
references an external source are proxied to the Camo server.
2019-09-04 21:01:54 +05:30
2019-12-04 20:38:33 +05:30
For example, the following is a link to an image in Markdown:
2019-09-04 21:01:54 +05:30
2019-12-04 20:38:33 +05:30
```markdown
```
2019-09-04 21:01:54 +05:30
2019-12-04 20:38:33 +05:30
The following is an example of a source link that could result:
2019-09-04 21:01:54 +05:30
2020-05-24 23:13:21 +05:30
```plaintext
2019-12-04 20:38:33 +05:30
http://proxy.gitlab.example.com/f9dd2b40157757eb82afeedbf1290ffb67a3aeeb/68747470733a2f2f61626f75742e6769746c61622e636f6d2f696d616765732f70726573732f6c6f676f2f6a70672f6769746c61622d69636f6e2d7267622e6a7067
```
