Docs

Torch Object Storage

Image processing

Original image protection

Original image protection is a security feature that prevents unauthorized access to images by anonymous users. When enabled, anonymous users cannot access images directly via their URLs. Instead, access is restricted to URLs that contain image style parameters or pre-signed URLs. This topic describes how to use original image protection.

Introduction

When original image protection is enabled, anonymous users can only access images in the following ways:

URLs with image style parameters, in the format https://<bucket name>.<Endpoint>/<image name>?x-tos-process=style/<style name>. For more information, see Using image styles.

Pre-signed URLs in the format https://<bucket name>.<Endpoint>/<image name>?<signature>. For more information, see Presigning overview.

Steps

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Data processing > Image processing.

On the Image processing page, click the Original image protection tab, and then click Edit.

On the Original image protection tab, set the following parameters:

Parameter	Description
Original image protection	Select whether to enable Original image protection.
Original image protection suffix	Select the file extension(s) to which you want to apply the original image protection feature. Once configured, all images with the selected extension(s) will be secured. The details are as follows: Supported extensions: , png, jpg, jpeg, gif, bmp, tiff, heic, and webp. Selecting wildcard () will apply the original image protection feature to all objects in the bucket, including both image and non-image files. You can select multiple extensions simultaneously.
Custom delimiter	You can use a custom delimiter to replace the image style parameter (?x-tos-process=style/) to shorten the image URL. The following four delimiters are supported: hyphen (-), underscore (_), forward slash (/), and exclamation mark (!). For example, if the URL with the image style parameter is https://test.tos-cn-beijing.volces.com/abc.jpg?x-tos-process=style/test, and you use a hyphen (–) as the custom delimiter, you can use the URL https://test.tos-cn-beijing.volces.com/abc.jpg-test to access the image.
Suffix	After a custom delimiter and a suffix are set, TOS will automatically add the suffix to the image name during processing. This eliminates the need to manually enter the full name of the image in the URL. For example, if you set the custom delimiter to - and want to process an image named fast_a.jpg with the test style, you can set the suffix to _a.jpg, and then use the simplified URL "https://test.tos-cn-beijing.volces.com/fast-test" to process the image. If you use "https://test.tos-cn-beijing.volces.com/fast_a.jpg-test" to process the image, TOS will attempt to process an image named fast_a.jpg_a.jpg (the original filename with a suffix added). If fast_a.jpg_a.jpg does not exist, an error will occur. warning You can configure only one suffix per bucket, and it cannot exceed 1,024 characters. You must set a custom delimiter before setting the suffix. It does not apply to URLs that use image style parameters, such as https://test.tos-cn-beijing.volces.com/abc.jpg?x-tos-process=style/test. Once configured, the suffix will automatically be appended to the original filename in all image processing requests that use the custom delimiter. Make sure the object (the original filename with a suffix added) exists in the bucket. Otherwise, a NoSuchKey error will occur during processing.

Click Select.

Last updated: 2026.08.14 16:23:29