Allow ws:// connections to .onion destinations from secure HTTPS origins
Categories
(Core :: DOM: Security, enhancement)
Tracking
()
People
(Reporter: espinet.marien, Unassigned)
References
Details
Steps to reproduce:
- Opened a page served over HTTPS from a clearnet domain (e.g. https://example.fr)
- From that page, attempted to open a WebSocket connection to a .onion address:
new WebSocket("ws://abc123def456.onion:8080") - dom.securecontext.allowlist_onions is set to true in about:config
Actual results:
The connection is blocked by the Mixed Content Blocker:
The only available workaround is setting network.websocket.allowInsecureFromHTTPS = true,
which is overly broad — it allows ws:// from any HTTPS page to any destination, not just .onion.
Expected results:
When dom.securecontext.allowlist_onions = true, ws:// connections targeting .onion addresses
should be exempt from mixed content blocking, regardless of whether the source page is
a clearnet or .onion origin.
.onion addresses provide end-to-end encryption via the Tor network, making MITM attacks
impossible by design — the same security argument used to allow ws://localhost from HTTPS
origins in bug 1376309.
|
||
Comment 1•5 months ago
|
||
The Bugbug bot thinks this bug should belong to the 'Core::DOM: Security' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
Of course, I didn’t specify it in the “Steps to reproduce”, but this is in the context where a Tor SOCKS proxy is configured to resolve .onion domains.
|
||
Comment 3•5 months ago
|
||
Looking at where bug 1376309 is patched in websocket.cpp it would be pretty easy to add a call to nsMixedContentBlocker::IsPotentiallyTrustworthyOnion() there. And we'd have to add it to the upgrade-insecure-requests checks above to avoid a similar problem to bug 1729897
|
|
||
Updated•5 months ago
|
|
|
||
Comment 4•5 months ago
|
||
And similar code prevented upgrades in HTTPS-only mode
https://searchfox.org/firefox-main/rev/e535ba2be795ac33264c1106f6d98c5ace640f4d/dom/security/nsHTTPSOnlyUtils.cpp#215,222-223
Thanks for looking into this! I'll be waiting to test the patch when it's ready. Thanks for your work!
Description
•