Skip to content

imgix Secure Token

Service Name: imgix

Service Description: imgix is a real-time image processing service and CDN that transforms, optimizes, and delivers images to improve web performance. It allows developers to manipulate images on-demand through URL parameters.

Service Address: https://imgix.com/

Validation Type: API Auth

IP Allow list: Does not exist at the token level, but imgix offers domain-level security settings.

Secret Access Scope: Grants access to generate secure URLs for private imgix sources, preventing unauthorized image access and URL parameter tampering.

Secret Revokement URL: https://dashboard.imgix.com/sources (Requires regenerating the token through the dashboard)

Secret Example: 9FiyCrvUTsyxMEQrEwjq (Note: actual tokens are typically longer and more complex)

Suspicious Activity Investigation Instructions:

  • Review imgix analytics for unusual traffic patterns or spikes in image requests
  • Check for unauthorized domains accessing your imgix sources
  • Monitor for unusual image transformations or parameter usage
  • Review server logs for attempts to bypass secure URL signatures
  • Check for unexpected billing increases that might indicate unauthorized usage

Mitigation Instructions:

  • Log in to the imgix dashboard at https://dashboard.imgix.com/

  • Navigate to the affected source

  • Click on "Settings" for the source

  • Under the "Security" section, click "Regenerate" next to the secure token
  • Update the token in all your applications and services
  • Consider enabling additional security features like "Secure URLs" if not already

enabled

  • Update any Content Security Policies (CSP) if necessary
  • Monitor for any continued unauthorized access after token rotation