When you can't edit the size in an image URL: signed variants on itch.io and Flickr

In my last two posts I rewrote size tokens in image URLs: change feed_thumbnail to feed_fullsize, drop .600x338, and the CDN hands you the bigger file. That trick has a limit. Some CDNs sign each size, so the URL for the large copy contains a value you can't compute from the small one. Edit the size and keep the old signature, and the server refuses.

I measured two sites that work this way and one that doesn't, on 10 November 2026. Each file was fetched with curl (Flickr through Chrome, since it rate limits plain curl from my IP) and the pixel size was read from the image itself with Pillow or createImageBitmap.

itch.io: a signature per size

A screenshot on an itch.io game page looks like this:

https://img.itch.zone/aW1hZ2UvNDM0NTU0LzcwMTEwMTIuanBn/347x500/ca0rKj.jpg

The first segment is base64 for image/434554/7011012.jpg, the stored file. The second is the size box. The last one, ca0rKj, is a signature over both. The page uses three variants of that screenshot, each with its own signature:

Now the obvious edit, swapping the size and keeping the signature:

The last row matters: the signature covers the image path too, so you can't reuse one valid original signature across screenshots. Without the server's secret there is no URL to construct.

The page already has the answer, though. Here is the markup, trimmed:

<a data-image_lightbox="true"
   href="https://img.itch.zone/aW1hZ2Uv.../original/3t28LO.jpg">
  <img src="https://img.itch.zone/aW1hZ2Uv.../347x500/ca0rKj.jpg"
       srcset=".../347x500/ca0rKj.jpg 1x, .../794x1000/ei%2BnwE.jpg 2x"
       class="screenshot">
</a>

The lightbox link points at the 1920×1080 upload, already signed.

Flickr: a different secret per size

Flickr URLs put a hex secret before the size letter. On one Explore photo:

So the small sizes share one secret and the large ones don't. The photo page's HTML lists the large sizes with their own secrets:

Three sizes, three secrets, none derivable from 37e1244f5b. On Explore and album grids only the small URLs are in the DOM, so anything that works from the grid has to stop at _b or go fetch every photo page.

Gumtree: a named variant, no signature

For contrast, Gumtree's image CDN names its variants and checks nothing else. One ad photo:

Here a rewrite rule is fine, because the variant name is the whole key. I can't tell whether /public is the uploaded file or just the largest variant, only that it's the largest one I found.

What the extension does about it

When the size is signed, guessing a URL is pointless, so the image downloader I build does two cheaper things. First, when an <img> is wrapped in a link whose href looks like an image file, it keeps that link as the full-size candidate:

const IMG_LINK_RE = /\.(jpe?g|png|gif|webp|avif|bmp|svg|tiff?|jfif)(?:$|[?#])/i;

const a = el.closest('a[href]');
const href = a && a.getAttribute('href');
const linkFull = href && IMG_LINK_RE.test(href) ? href : null;

On itch.io that picks up original/3t28LO.jpg for every screenshot, with no site-specific code. Second, it parses srcset per the HTML spec and takes the largest candidate, so even without the link it would get the 794 px copy instead of the 347 px one.

The link still goes through the same URL rules as everything else, because some gallery links are themselves resized copies, and the unmodified link stays as a fallback if the rewritten one fails. For Flickr the rule only rewrites small suffixes to _b; a test pins that boundary so nobody "improves" it into a 410 later.

The general lesson I took from this: before writing a rewrite rule, fetch the variant with the old signature and see whether the server checks it. If it does, look in the page for a link or a srcset the site already signed for you.

I wrote up the itch.io steps, with and without an extension, here: how to download itch.io screenshots in full size. The extension that does the link and srcset handling above is PixLasso, a Chrome extension for saving images from a page.