Skip to content

fix(BUY-59983): add images.remotePatterns allowlist for catalog image hosts#200

Open
BuyWhere wants to merge 1 commit into
mainfrom
BUY-59983-image-proxy-allowlist
Open

fix(BUY-59983): add images.remotePatterns allowlist for catalog image hosts#200
BuyWhere wants to merge 1 commit into
mainfrom
BUY-59983-image-proxy-allowlist

Conversation

@BuyWhere

@BuyWhere BuyWhere commented Jul 7, 2026

Copy link
Copy Markdown
Owner

Summary

Fixes #BUY-59983 — /_next/image proxy returns HTTP 400 for every product image, breaking all product cards.

Root cause

next.config.mjs had no images.remotePatterns allowlist. Every <Image> component rendering an external product image URL was rejected by the /_next/image optimizer, returning HTTP 400. Confirmed live:

GET https://buywhere.ai/_next/image?url=https%3A%2F%2Fpicsum.photos%2F200%2F300&w=640&q=75  → 400
GET https://buywhere.ai/_next/image?url=https%3A%2F%2Fm.media-amazon.com/...               → 400

Fix

Add images.remotePatterns for every upstream catalog image host the app actually renders:

  • picsum.photos — fallback/placeholder images (USPriceComparison, USProductDetail, ProductComparison, us-products)
  • m.media-amazon.com, images-na.ssl-images-amazon.com — Amazon product catalog (trending-products.json)
  • cf.shopee.sg, s.shopee.sg, **.shopee.sg — Shopee catalog CDN
  • images.unsplash.com — stock imagery on landing/hero

Verification

  • next.config.mjs parses via node --input-type=module import: 7 remotePatterns loaded.
  • No domains/remotePatterns existed on main prior to this change.

Note on prior work

Earlier heartbeat runs reported a fix as commit a8627c1d2 ("Fix Next image proxy host allowlist"), but that commit does not exist in this repo (verified git cat-file + full history search) and remotePatterns was never present on any branch. This PR is the actual source fix.

Deployment

After merge, requires a production redeploy of the Next.js frontend for the new config to take effect (Railway).

…image hosts

The /_next/image proxy returned HTTP 400 for every external product
image because next.config.mjs had no images.remotePatterns allowlist.
Add the upstream catalog image hosts the app actually renders via <Image>:
picsum.photos (fallback), m.media-amazon.com + ssl-images-amazon
(Amazon), cf/s.shopee.sg + *.shopee.sg (Shopee), images.unsplash.com.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant