ASA2 Image Proxy 1.0.1 is now available, the first bugfix release since the 1.0.0 launch. It fixes two issues reported by early users. Image fetches failed on redirecting source hosts, and a Dashboard time range reset on every page load.

Both fixes are drop-in. No configuration changes are needed.

ASA2 Image Proxy 1.0.1 Fixes Source-Image Redirects

Many shops don’t serve product images from a final, stable URL. They route through a tracking layer or a CDN redirect first. That layer answers with an HTTP 301, 302, 303, 307, or 308 before handing back the actual image.

ASA2 Image Proxy 1.0.0 disabled redirect-following entirely and treated any of these responses as a fatal fetch error.

The report that surfaced this came from a MediaMarkt product image, not an Amazon one. The URL redirected through a path with duplicate slashes, similar to https://host//trck//eview//.... Both problems together, the redirect and the malformed path, made the fetch fail.

ASA2 Image Proxy runs on any shop ASA2 manages, and this bug showed up on a shop that isn’t Amazon. That’s a useful data point for the proxy’s design.

Every Redirect Hop Passes Through the SSRF Guard Again

The proxy now follows redirects itself instead of handing that job to WordPress’s wp_remote_get(). That function is still called with redirection => 0 on every request. The plugin’s own code decides whether to follow a Location header.

Each hop is re-validated against the full security pipeline before it is requested: DNS resolution, the private-IP blocklist, and the origin allowlist. A compromised or misconfigured upstream can’t smuggle a private URL past this on a second or third hop. Only checking the first hop would leave that door open.

Malformed redirect targets with duplicate slashes in the path, the MediaMarkt case, are normalized before ASA2 follows them. A hop-count limit now produces a typed TOO_MANY_REDIRECTS error instead of an infinite loop. A 3xx response with no usable Location header gets its own typed INVALID_REDIRECT error too.

No configuration is required. Images that previously failed through the proxy, visible as a fetch error in Test Fetch or the Dashboard’s recent-errors panel, now load normally.

Full details on the SSRF guard and the origin allowlist are in the Image Proxy security documentation.

Dashboard Time Range Now Persists Between Visits

The Dashboard‘s 7-day and 30-day selector reset to the 7-day default every time the Image Proxy page was reopened from the WordPress admin menu. The choice survived in-app navigation and a same-URL reload, because it lived in the router’s query parameter. A fresh page load carries no query string, so the default always won.

ASA2 Image Proxy 1.0.1 also stores the selection in the browser’s local storage. An explicit URL parameter still wins, so a bookmarked or shared dashboard link keeps showing that link’s range.

Otherwise the stored value applies, and the 7-day default is used only on a genuine first visit. The setting applies per admin and per browser.

Bug Fixes

• Redirect handling: A 301, 302, 303, 307, or 308 redirect from the source image host was treated as a fatal fetch error. The proxy now follows redirects itself, re-validates every hop against the SSRF and origin-allowlist checks, and normalizes malformed targets with duplicate slashes (asa2-2)
• Dashboard time range: The 7/30-day selector was not remembered between visits. It now persists across page reloads via local storage (asa2-1)

Technical Requirements

• PHP: 8.1 or higher (unchanged)
• WordPress: 6.0 or higher, tested up to 7.1 (bumped from 6.9.4)
• Migration: None. No database changes and no settings need to be reconfigured

Getting Started

1. If you have it installed already, update ASA2 Image Proxy through the WordPress dashboard, or download version 1.0.1 from your account area. Otherwise get it from the ASA2 Image Proxy product page.
2. If product images were previously failing to load, check the Dashboard’s recent-errors panel or run Tools > Test Fetch to confirm they now succeed
3. No settings need to be revisited; both fixes apply automatically once the update is active

For questions or issues, visit the help page. Full documentation is available at docs.getasa2.com, including the Troubleshooting guide. The complete release history is on the changelog page.