[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #18080 [Tor Browser]: Do not strip the Access-Control-Allow-Origin header
#18080: Do not strip the Access-Control-Allow-Origin header
-------------------------+-----------------------------------
Reporter: cypherpunks | Owner: tbb-team
Type: defect | Status: needs_information
Priority: Medium | Milestone:
Component: Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: | Actual Points:
Parent ID: | Points:
Sponsor: |
-------------------------+-----------------------------------
Comment (by gk):
Replying to [comment:7 cypherpunks]:
> The steps to reproduce this issue reliably are now
>
> 1. Go to [https://onionoo.torproject.org/summary?limit=1].
> 2. Open the Firefox Developer Tools window.
> 3. Go to the Network tab.
> 4. Use a new Tor circuit for the page.
> 5. The Access-Control-Allow-Origin header should now be among the
response headers of the first shown request.
> 6. Refresh the page with F5.
> 7. The Access-Control-Allow-Origin header isn't among the response
headers of the first shown request anymore.
This happens in a vanilla Firefox as well and is probably related to the
refresh behavior done via F5. If I reload the page with Ctrl+Shift+R I
always get the Access-Control-Allow-Origin header. So, I guess this is not
a bug. That said, while testing I did not encounter the "Cross-Origin
Request Blocked:"-message. Thus, there might still be more to it. How can
I reproduce that one?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18080#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs