When opening an image directly inside Tor-browser it ends up being downloaded twice.
Two HTTP GET requests get sent to the server.
The issue comes from the icon shown on the tabbar:
If I disable browser.chrome.favicons and browser.chrome.site_icons then the double download does not happen.
Can this be prevented by for instance loading the tab icon from the cache?
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Child items 0
Show closed items
No child items are currently assigned. Use child items to break down this issue into smaller parts.
Linked items 0
Link issues together to show that they're related.
Learn more.
This is on version 4.5.3.
It is also only noticeable on the server logs: in the browser itself you can only see one request (in the console or network tab). I don't have an example url handy, but could simulate it with python's builtin http server (python -m http.server) and using a service like ngrok.com to make the server accessible publicly.
I tried doing this on the 5.0 version and there the download does not happen twice, so it looks like this is already solved.
$exitIP1 is the IP shown for the circuit in Torbutton. IP2 confirmed via Atlas as Exit.
So it's not images per se, but favicons that get fetched a second time, via unrelated circuit.
Privacy implications?
Trac: Sponsor: N/AtoN/A Summary: Tor-browser downloads images twice to Tor-browser downloads favicon twice Resolution: worksforme toN/A Status: closed to reopened
So, there are two things here: 1) Downloading the favicon twice. I'd guess this is an underlying Mozilla problem: https://bugzilla.mozilla.org/show_bug.cgi?id=583351. 2) Downloading the favicon over a different circuit. I can observe 1), too, on some websites but it seems all those second requests go over the same circuit. Is 2) reproducible for you? If so, do you have an example site allowing us to debug the Tor Browser behavior?
So, there are two things here: 1) Downloading the favicon twice. I'd guess this is an underlying Mozilla problem: https://bugzilla.mozilla.org/show_bug.cgi?id=583351. 2) Downloading the favicon over a different circuit. I can observe 1), too, on some websites but it seems all those second requests go over the same circuit. Is 2) reproducible for you? If so, do you have an example site allowing us to debug the Tor Browser behavior?
Sorry for the late reply.
I doubt 1) is the cause here, ticket:17998#comment:2 would be my guess, too.
It is reproducible, but:
It happens only on the first request to the site, I could not trigger it a second time in the same Tor Browser session. Reloading, getting a new circuit in torbutton, closing/reopening tabs... nada.
Requests to the favicon don't show up in any FF DevTool.
Considering I don't reference the favicon in my HTML, Mozilla is doing some magic here. A quick search turned up complaints about it on Bugzilla reaching back to FF 0.10, it looks like preffing off browser.chrome.favicons disables this behavior and leaves correctly referenced favicons intact.
So this might be a cheap and easy fix at the cost of loosing favicons on sites which simply dump it in their web-root directory and expect it to work (besides me and mozilla.org, nobody really seems to be doing this).
I couldn't get my TB to log to a file as per your instruction in the other ticket, do you still want a testcase with all this info?
So, there are two things here: 1) Downloading the favicon twice. I'd guess this is an underlying Mozilla problem: https://bugzilla.mozilla.org/show_bug.cgi?id=583351. 2) Downloading the favicon over a different circuit. I can observe 1), too, on some websites but it seems all those second requests go over the same circuit. Is 2) reproducible for you? If so, do you have an example site allowing us to debug the Tor Browser behavior?
Sorry for the late reply.
I doubt 1) is the cause here, ticket:17998#comment:2 would be my guess, too.
They could well be the same issue.
It is reproducible, but:
It happens only on the first request to the site, I could not trigger it a second time in the same Tor Browser session. Reloading, getting a new circuit in torbutton, closing/reopening tabs... nada.
Requests to the favicon don't show up in any FF DevTool.
Considering I don't reference the favicon in my HTML, Mozilla is doing some magic here. A quick search turned up complaints about it on Bugzilla reaching back to FF 0.10, it looks like preffing off browser.chrome.favicons disables this behavior and leaves correctly referenced favicons intact.
So this might be a cheap and easy fix at the cost of loosing favicons on sites which simply dump it in their web-root directory and expect it to work (besides me and mozilla.org, nobody really seems to be doing this).
So, there are two things here: 1) Downloading the favicon twice. I'd guess this is an underlying Mozilla problem: https://bugzilla.mozilla.org/show_bug.cgi?id=583351. 2) Downloading the favicon over a different circuit. I can observe 1), too, on some websites but it seems all those second requests go over the same circuit. Is 2) reproducible for you? If so, do you have an example site allowing us to debug the Tor Browser behavior?
Sorry for the late reply.
I doubt 1) is the cause here, ticket:17998#comment:2 would be my guess, too.
It is reproducible, but:
It happens only on the first request to the site, I could not trigger it a second time in the same Tor Browser session. Reloading, getting a new circuit in torbutton, closing/reopening tabs... nada.
Requests to the favicon don't show up in any FF DevTool.
Interesting. FWIW: I see favicon requests in the browser console. Still, looking at the log output visiting mozilla.org shows everything goes over the same circuit. What OS are you on?
Considering I don't reference the favicon in my HTML, Mozilla is doing some magic here. A quick search turned up complaints about it on Bugzilla reaching back to FF 0.10, it looks like preffing off browser.chrome.favicons disables this behavior and leaves correctly referenced favicons intact.
So this might be a cheap and easy fix at the cost of loosing favicons on sites which simply dump it in their web-root directory and expect it to work (besides me and mozilla.org, nobody really seems to be doing this).
I couldn't get my TB to log to a file as per your instruction in the other ticket, do you still want a testcase with all this info?
Yes, please. I assumed you were using Linux. If you extract the Tor Browser and change into the tor-browser_LOCALE directory, starting Tor Browser with ./start-tor-browser.desktop --log should give you a tor-browser.log file in the same directory. If you set the Torbutton logging to level 3 as described you should see the circuit isolation at work.
Interesting. FWIW: I see favicon requests in the browser console. Still, looking at the log output visiting mozilla.org shows everything goes over the same circuit. What OS are you on?
I'm on Win10 x64 and you can scratch my previous observations, I was testing a bunch of sites after flipping the aforementioned pref, obviously the requests on my site went away but mozilla.org didn't break because they don't reference a favicon, but because the secondary circuit must have timed out.
Yes, please. I assumed you were using Linux. If you extract the Tor Browser and change into the tor-browser_LOCALE directory, starting Tor Browser with ./start-tor-browser.desktop --log should give you a tor-browser.log file in the same directory. If you set the Torbutton logging to level 3 as described you should see the circuit isolation at work.
Can't get this to work on Windows.
Btw: opening 'Page Info' triggers resource fetches via unrelated circuits, too.
Yeah, that's annoying and #15555 (moved) assuming you meant the view-source feature.
No, I'm talking about Tools >> Page Info, or right-clicking in a page >> View Page Info, clicking the lock or globe in the URL-bar >> more information is another way to open this, don't even need to select the media tab there.
Yes, please. I assumed you were using Linux. If you extract the Tor Browser and change into the tor-browser_LOCALE directory, starting Tor Browser with ./start-tor-browser.desktop --log should give you a tor-browser.log file in the same directory. If you set the Torbutton logging to level 3 as described you should see the circuit isolation at work.
Can't get this to work on Windows.
Ah, okay. After setting the log level to 3 you should be able to see the log in the browser console as well. If you need to increase the log lines available devtools.hud.loglimit.console is your friend.
Btw: opening 'Page Info' triggers resource fetches via unrelated circuits, too.
Yeah, that's annoying and #15555 (moved) assuming you meant the view-source feature.
No, I'm talking about Tools >> Page Info, or right-clicking in a page >> View Page Info, clicking the lock or globe in the URL-bar >> more information is another way to open this, don't even need to select the media tab there.
Ah, okay. After setting the log level to 3 you should be able to see the log in the browser console as well. If you need to increase the log lines available devtools.hud.loglimit.console is your friend.
Great, I was looking at the Web Console and Network Tools, which show nothing.
Here's my log for the first request of the session to check.torproject.org, tor-on.png is used as favicon, not sure if anything but the stuff around the two GETs near the end is relevant:
Okay, this seems to be a Windows-only issue. Fun. I can see the same behavior on a Windows 8 box but neither on OS X nor Linux. At least we can debug and fix it now, thanks cypherpunk. Oh, and FWIW you might want to consider to change your guard node (e.g. by using a fresh Tor Browser and re-customizing that one, or getting rid of your state file) as you exposed it in your log in comment:13 in case you did not do that already.
Trac: Keywords: N/Adeleted, TorBrowserTeam201601 added Status: needs_information to assigned Cc: fxs, isis to fxs, isis, arthuredelstein
Trac: Summary: Tor-browser downloads favicon twice (and over different circuits) to Tor-browser downloads favicon twice (and over different circuits) on Windows
browser.chrome.site_icons set to false until fixed.
(and, please, make it default for TBB until these vulnerabilities are fixed.)
And why have you left this bug in TorBrowserTeam201603?
UPD: this seems to be an underlying base for Options / General / Show tab previews in the Windows taskbar.
Why can't you temporarily apply the fix (as you did in #16998 (moved)) in comment:19? Crash, #18513 (moved), this ticket, what else is acceptable in stable?
See: comment:13:ticket:17761 for why. I only tested it back then in the crash context, though. And, again, please don't mess with the keywords. Especially not those that are responsible for tracking our monthly workload. Thanks.
Do you think it wasn't seen? How did you test it? That pref completely disables favicons, they even don't load from websites. Or is there a hole that Mozilla doesn't know?
Keyword was replaced to return this ticket to your radar in order to raise your attention. But if it's only a mess for you, then sorry. It seems we have different points of view about security.
I flipped the preference and Tor Browser was still crashing. Apart from that, instead of messing with our keywords providing a workaround patch (be sure that you disable favicons only for Windows), setting the ticket to needs_review and linking, ideally, to test builds would be a much better approach. Above all it would show that you are really caring about this topic.
I bet this is happening in WindowsPreviewPerTab.jsm. If so, this is probably the windows per-tab taskbar preview ("Aero Peek") functionality which is turned off but still doing network requests. Mozilla hit this while trying to fix the issues mentioned in #18513 (moved).
I bet this is happening in WindowsPreviewPerTab.jsm.
It was mentioned in comment:19
If so, this is probably the windows per-tab taskbar preview ("Aero Peek") functionality which is turned off
No, it's not turned off, just hidden.
but still doing network requests.
No, it's not doing that, but that bug does
Mozilla hit this while trying to fix the issues mentioned in #18513 (moved).