[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #13900 [Tor Browser]: Write Firefox patch for removing third-party HTTP authentication tokens
#13900: Write Firefox patch for removing third-party HTTP authentication tokens
-------------------------+-------------------------------------------------
Reporter: gk | Owner: mcs
Type: | Status: assigned
enhancement | Milestone:
Priority: normal | Version:
Component: Tor | Keywords: tbb-linkability, tbb-firefox-patch,
Browser | tbb-testcase, TorBrowserTeam201501
Resolution: | Parent ID:
Actual Points: |
Points: |
-------------------------+-------------------------------------------------
Comment (by mcs):
Kathy and are working on this. Our current thinking is that we will
modify nsHttpChannel::BeginConnect() and nsHttpChannel::DoAuthRetry() to
suppress the Authorization header when the request is a third party one.
That approach will keep the behavior consistent with what is implemented
by Torbutton's stanford-safecache.js code today.
We will use methods from ThirdPartyUtil to determine if the request is a
third party request. We may need to whitelist requests whose parent is
"chrome://browser/content/browser.xul" to allow for authenticated favicon
requests (as is done in stanford-safecache.js).
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13900#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs