Gravacacher Gravacacher is very simple and lightweight caching server designed for one specific purpose: to cache avatar images.
Download

Gravacacher Ranking & Summary

Gravacacher Tags

server caching server cache avatar images avatar cacher caching avatars

Gravacacher Description

Gravacacher is very simple and lightweight caching server designed for one specific purpose: to cache avatar images. Gravacacher is very simple and lightweight caching server designed for one specific purpose: to cache avatar images from services like www.gravatar.com, which provide "globally recognized avatars".Typically, Gravacacher will be deployed on sites that host blogs or forums which depend on gravatars. The Gravacacher project supports a security mechanism that allows it to answer only queries made via URLs generated by your server software, such as blog or forum engines, permanent cached entities, and both positive and negative TTLs when caching.Here are some key features of "Gravacacher":· Supports security mechanism to allow access only to those avatars your web software has generated links to, more on that below.· Supports multiple sites – I do not know any other service except gravatar.com at this moment, but it’s possible new ones could appear.· Supports “permanent” avatars, i.e. those that never expire – useful for your own avatars stored on your own web server.· Supports both positive and negative TTLs for cached avatars.· Supports “default” avatars fetching even if main server is down or overloaded – those fetched avatars will not be resized, though, so make sure the link points to the image of correct size.Security mechanism explanationThe basic idea is to prevent others of using your gravacacher installation as free gravatar.com caching proxy for their own needs.Leaving your avatars proxy open could not only cause unwanted system load and traffic, but also in the case of some error from gravatar.com or other server you could cache – for example, if the server you cache does not validate “default” parameter well enough – the unrestricted installation would in fact become open general-purpose HTTP proxy server, which is even more dangerous.To overcome that the following is done:Link generator (which is typically some blog / forum engine) besides of generating the usual set of parameters necessary for fetching the information from gravatar.com or other server, also generates MD5 hash of “password” + “parameters”, where “password” is known only to gravacacher and generator engine. This hash is appended to the set of parameters that are put in the link.When serving request, gravacacher calculates MD5 hash of reveiver parameters (excluding the hash, of course) and compares it with the received hash. If these do not match – request is denied.Here’s one simple example, using fake hashes / ids for clarity.Suppose that the request we would normally generate ishttp://www.gravatar.com/avatar.php?gravatar_id=12345&size=80&default=http://www.example.com/default_image.pngParameters here are “gravatar_id=12345&size=80& default=http://www.example.com/default_image.png”If password is “bla-bla-bla” and gravacacher installation is accessible as “www.example.com/gravacacher.fcgi” then the generating software should perform the following:gravacacher_id = MD5("bla-bla-blagravatar_id=12345&size=80& default=http://www.example.com/default_image.png") Let gravacacher_id from the previous step be “67890”.Then we generate new URL by putting gravacacher_id there and replacing www.gravatar.com by gravacacher url resulting in the following url: http://www.example.com/gravacacher.fcgi?gravatar_id=12345&size=80& default=http://www.example.com/default_image.png&gravacacher_id=67890 Please note that this feature does not prevent unauthorized retrieval of avatars from your cache that you generated links to – after all, it’s almost impossible to know if requester is the “valid” one – i.e. that one who just downloaded the page from your server and now asks for avatars by links from that page, unlike somebody who fetched the page some time ago and now repeatedly uses generated link to fetch the avatar over and over.However, it does prevent others from using your cache to retrieve things you’ve never generated links to – and that, I beleive, should be enough for most people. If not, consider implementing some form of passwords rotation, so that the password used for generating links is changed once in a while, rendering all previous links invalid.Finally, of course, if despite all dangers you want unrestricted access - you can turn security check off by specifying empty password in config and omitting gravacached_id from your links – then gravacacher will work in unrestricted mode.

Gravacacher Related Software