Do some browsers ignore image URLs with non-image (i.e. script) extensions?

Question

I read that extensionless image URLs are generally acceptable with the correct content-type header set.

However, if a script generates image output and sets the content type, but the URL in the image tag is .php for instance, will any browser deny the request as potentially malicious?

For instance:

<?php
// myimage.php
header( 'Content-Type: image/jpeg' );
echo read_file_contents( 'someimage.jpg.in' );

and

<img src="myimage.php" />

Answer 1

No - a browser will not deny the request as potentially malicious.

A response header defining the content type is important for this approach.

Two examples:

• A lot of financial sites use this approach to generate their stock charts dynamically, (but most of them switched to JS solutions).

• The logo of the official PHP website is rendered that way.

  http://php.net/images/logo.php

  The response header contains "Content-Type:image/png".

  And this is the source-code for it: https://github.com/php/web-php/blob/master/images/logo.php