1744290 - .onion domains should never be sent as referrers

Status: RESOLVED DUPLICATE of bug 1816916

(Core :: Privacy: Anti-Tracking, enhancement)

Description

[Mike Hoye [:mhoye]]

Glancing over my referrer logs, I can see a number of referrers coming from .onion domains. My sample size is small, but 100% of them involve UA strings that correspond with Firefox ESR releases.

For example:

access:[redacted IP addr] - - [30/Nov/2021:00:41:31 -0500] "GET /blarg/2019/09/06/forward-motion/ HTTP/1.1" 200 50125 "http://[redacted]j.onion/[redacted]" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0" 1050937

While this is arguably permitted for http->http transactions per the spec, this should probably never be allowed to happen.

Comment 1

[Daniel Veditz [:dveditz]]

Gecko already supports a pref that the Tor browser uses: network.http.referer.hideOnionSource (currently false in Firefox)

Making this change is easy if we decide to do it.

Comment 2

[Tom Ritter [:tjr] (OOTO until April)]

At the moment we're not sure if these are Firefox UAs or Tor Browser. Firefox might exaplin it, Tor Browser would mean a bug somewhere.

Mike would you be able narrow it down for us?

• Do you see any Firefox/91 user agents doing this?
• Can you plug a few IP addresses/dates into https://metrics.torproject.org/exonerator.html and see if it's coming from exit relays?

Comment 3

[Daniel Veditz [:dveditz]]

This was talked about in bug 1742405 comment 4, but that bug was really about the Origin: header and CORS requests from .onion sites so this could be a bug for the actual pref flip

Comment 4

[Mike Hoye [:mhoye]]

Of the ten hits in my logs going back to November 2nd, all of them are either FF60 or 78, and all of them are exit relays per the exonerator tool.

Comment 5

[morgan (Tor Project)]

Is there any good reason for network.http.referer.hideOnionSource to not be true by default in Firefox? This would help keep onion services private which are being visited by users with custom Firefox + system tor setups.

Comment 6

[Tom Ritter [:tjr] (OOTO until April)]

Oh yeah, I probably should have attached the patch to this. I don't think this bug is actionable in any way other than Bug 1816916, so I'm going to dupe it there.