Opened 6 months ago

Last modified 5 months ago

#34118 needs_information defect

Onion-Location banner isn't shown when using subdomains in the onion address

Reported by: ahf Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-9.5-issues
Cc: acat Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

MacLemon on Mastodon reports that we have a problem with the Onion-Location banner when a subdomain is added to the Onion hostname.

The purple ".onion available" banner is shown when the server sends: Onion-Location: http://<pubkey>.onion/, but it is NOT shown when the server sends: Onion-Location: http://subdomain.<pubkey>.onion/.

For more information, see the discussion here: https://chaos.social/@MacLemon/104112776746450550

Child Tickets

Change History (4)

comment:1 Changed 6 months ago by acat

Status: newneeds_information

I just tested with http://foo.<pubkey>.onion and it works for me. Just to makes sure, is MacLemon serving the header over https? We have three requirements for the header to be processed by the browser:

   * The Onion-Location value must be a valid URL with http: or https: protocol
     and a .onion hostname.

   * The webpage defining the Onion-Location header must be served over HTTPS.

   * The webpage defining the Onion-Location header must not be an onionsite.

This is from https://gitweb.torproject.org/tor-browser-spec.git/tree/proposals/100-onion-location-header.txt, which is probably the closes we have to a documentation of the header.

comment:2 Changed 6 months ago by ahf

I'm passing on the info, thanks!

comment:3 Changed 5 months ago by ahf

It looks like it's a problem when you mix Onion-Location with alt-svc: https://mastodon.social/web/statuses/104287008389695002

I'm not too sure if this is something we should special case handling for.

comment:4 Changed 5 months ago by acat

Keywords: tbb-9.5-issues added
Note: See TracTickets for help on using tickets.