Reference on WebP Server Documentation

Headers

Mon, 01 Jan 0001 00:00:00 +0000

Headers #

WebP Server Go will render the following header in response:

etag
- Example: W/"87328-49BF2BCE"
- This header is produced by W/"<content length>-<CRC Checksum of the file>"
x-compression-rate
- Example: 0.87
- This header is produced by size(webp_image)/size(original_image), if the value is bigger than 1, it means the converted webp image is bigger than the original image, hence the original image is return to the visitor.

Extra Parameters

Mon, 01 Jan 0001 00:00:00 +0000

Extra Parameters #

You can turn it on by setting "ENABLE_EXTRA_PARAMS": true in config.json.

Currently, we support the following params:

height
width
max_width
max_height

both are in px.

Example on `height` and `width` #

http://some-host.tld/path/to/nasa.jpg

http://some-host.tld/path/to/nasa.jpg?width=200

If you set both width and height, your image will be cropped using attention crop by default maintain your width-height ratio, like this:

http://some-host.tld/path/to/origin.png

http://some-host.tld/path/to/origin.png?width=400&height=800

Query Parameters

Mon, 01 Jan 0001 00:00:00 +0000

Query Parameters #

Besides Extra Parameters (width, height, and related options), WebP Server Go supports metadata query parameters on image requests.

`meta=full` #

Request full metadata for a resource as JSON:

GET /path/to/image.jpg?meta=full

Behavior:

Condition	HTTP status
Valid path and source exists (local file or reachable remote)	`200` with JSON body
Malformed or illegal path	`404 Not Found`
Valid path but source does not exist	`404 Not Found`

Previously, meta=full could return metadata from cache even when the source file was missing or the path was invalid. Current versions validate the path and confirm the source exists before returning metadata.

Security

Mon, 01 Jan 0001 00:00:00 +0000

Security #

WebP Server Go applies path validation before reading local files or resolving remote URLs. Invalid, malformed, or traversal attempts are handled consistently.

Path traversal protection #

The server rejects directory traversal in request paths, including encoded variants:

Attack pattern	Example	Result
Plain traversal	`/../etc/passwd`, `..%2f` in path segments	`404 Not Found`
Single URL encoding	`%2e%2e%2f`	`404 Not Found`
Double URL encoding	`%252e%252e%252f`	`404 Not Found`

Paths are decoded before segment checks so nested encodings cannot bypass validation.

Reference on WebP Server Documentation

Headers

Headers #

Extra Parameters

Extra Parameters #

Example on height and width #

Query Parameters

Query Parameters #

meta=full #

Security

Security #

Path traversal protection #

Example on `height` and `width` #

`meta=full` #