Security risks of pictures displayed in email addresses

Security risks of pictures displayed in email addresses
The code for loading images in html is: where the address of the SRC attribute is the image address, here, I want to write the image address as my website construction to collect the code of the user's previous address? So what information can I get? Starting from the URL that contains the element , the browser parses HTML code normally. When the img src is encountered, request the address specified by SRC. SRC is the address we specified. we can control the PHP file. This file can read the previous address of the file when asked, for example, Referer in the URL. You can get the visitor's browser, user's IP address, and the type of the device to access, in the traditional WAP or APP (essentially Web), Referer may include user ID tokens, which may cause easy disclosure of identity tokens, account theft, or as long as the scenario is well designed, there is a probability that users will be phishing. Based on the above situation, we found that the root cause of this problem is that users can indirectly direct traffic by controlling SRC. If you know the reason. In fact, there are two ways to restrict external image resources: one is to prohibit external image resources of the website, and the other is to cache external resources on the server if you use external resources. Then, the image resource is displayed by calling the cache resource on the local server. Google's gmail mailbox uses similar technologies. In early years, Forum programs such as discuz allowed users to reference external images in custom portraits. As a result, webmasters began to collect others' IP addresses, browsers, and operating systems using Yahoo's Statistics Code (an image url. Later versions of discuz will be banned. Mailbox is also a truth. Currently, 51la, cnzz and other free statistics support statistics through image URLs. You can register a number to try it. This method can be used to collect data from other websites. All posts you post can be counted. Currently, many websites (such as zhihu) do not directly link an external image to . This is also the reason.