Next.js Discord

Discord Forum

Confused about malicious user protection in `next/image` `remotePatterns`

Answered
Satin Angora posted this in #help-forum
Open in Discord
Satin AngoraOP
Hello!

https://nextjs.org/docs/app/api-reference/components/image#remotepatterns

According to the documentation, in order to display external images using next/image, I need to configure the remotePatterns property in next.config.js so as to prevent from malicious users. What exactly does malicious usage entail in this scenario? How would next/image be exploited if we didn't restrict which external images/links could be used?

Thanks!
Answered by joulev
I can use https://yourwebsite.com/_next/image as my own image optimiser thereby burning your server if you dont use vercel or shooting your vercel bill up if you do use vercel
View full answer

6 Replies

Answer
Satin AngoraOP
Gotcha thank you so much!! @joulev
Satin AngoraOP
@joulev so just to be clear, a malicious actor could use any next/image component in the site and just “hijack” it by changing the image source to their own URL?
Like through dev tools or something?
@Satin Angora <@484037068239142956> so just to be clear, a malicious actor could use any `next/image` component in the site and just “hijack” it by changing the image source to their own URL?
joulev
all nextjs apps have the /_next/image endpoint that can be used to optimise images. bad actors don't even need to use nextjs, they can simply use your /_next/image anywhere to harm you
Satin AngoraOP
@joulev thank you so much!