在电子邮件上显示图像总是[关闭]

Question

I have built an email system that makes when you are upright in the database for user sent an email but what is the problem is that the image will not show up, but must specify that it must be like for love to appear forward as you can see in the picture here:

http://billedeupload.dk/images/TaWuJ.png

I just like like all possible other sites such as facebook that their logo is there all the time. I just like the same way that the image also get shown all the time without user to do anything.

I've done like this:

<div style="background:#666; color:#FFF; margin:0 auto; width: 960px;">
 <img src="http://www.blabla.dk/indhold/img/banner-2.png">

Answer 1

The code you have written is perfectly right. The images are not displayed by default in many of the mail clients like GMail, ThunderBird, etc. You need to click on the Display Image link. This process cannot be automated. It is a security measure to prevent CSRF.

Some references follows:

LifeHacker:

By default, Gmail tries to protect your email from spammers by blocking images in emails until you tell it to show them. That's nice and all, but it's a bit annoying when you want to see images from your contacts.

Gmail now doesn't display images in my email. - Google Groups

With the change to using HTTPS by default, your connection to Gmail is encrypted through HTTPS. However, some messages you may receive, such as ads and newsletters, may contain images that aren't sent via HTTPS, and instead via HTTP.

Browsers like Internet Explorer, will warn you with a pop-up indicating that you may be trying to access content that is being sent through HTTP while you connected to Gmail via HTTPS. This is why enabling the displays of mixed content for Internet Explorer helped some of you. However, please be cautious whenever enabling the displays of HTTP content, as some sites may have risky or malicious content that the browser setting is trying to protect you from.

Why do emails not load images directly

Email providers like Gmail,yahoo,hotmail do not load images in the email directly. These services require you to allow the images to be laoded. Why do they do this? Is it to prevent XSS/CSRF?

Two reasons - Privacy and CSRF.

Privacy

It allows the sender to figure out whether I have opened the email or not, without my knowledge. Spammers can figure out whether their "marketing" campaigns have had any impact or not.

CSRF

For CSRF to work, the victim has to click a link or visit the attackers page. If email clients were to display images automatically, just opening an email would be sufficient to launch a CSRF attack.

For example, lets assume paypal had a csrf vulnerability. Also assume that the user was logged on to paypal. Now, an attacker sends the user an email with <img src="http://paypal.com/transferfunds?fromAccount=victim&toAccount=attacker"/>. As soon as the user opens the email, funds would get transferred.