Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not enforce SSL for Tor Hidden Service .onion URLs #7068

Closed
wants to merge 3 commits into from
Closed

Do not enforce SSL for Tor Hidden Service .onion URLs #7068

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1bda155
Do not enforce SSL for Tor Hidden Service .onion URLs
saizai Jul 16, 2012
091c40a
Simplify host call
saizai Jul 16, 2012
c2fbcbd
Add @pixeltrix's test case
saizai Jul 16, 2012
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 6 additions & 1 deletion actionpack/lib/action_dispatch/middleware/ssl.rb
View file
Open in desktop
Expand Up @@ -19,12 +19,17 @@ def initialize(app, options = {})

def call(env)
request = Request.new(env)

if request.ssl?
status, headers, body = @app.call(env)
headers = hsts_headers.merge(headers)
flag_cookies_as_secure!(headers)
[status, headers, body]
elsif URI(request.url).host =~ /\.onion$/
# Do not enforce SSL on Tor hidden services (e.g. if this server hosts content both over SSL and Tor).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are you parsing the url with URI - request.host should work shouldn't it?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just using the same syntax as the similar code below it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That section of code modifies the url - your addition just needs to check the host so there's no need to use URI()

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair enough. Changing.

# CAs cannot verify .onion ownership for SSL (so it provides no auth),and SSL introduces leaks that actually degrade Tor security/privacy.
# Cf. https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ?version=1390#WhyisitbettertoprovideahiddenserviceWebsitewithHTTPratherthanHTTPSaccess
@app.call(env)
else
redirect_to_https(request)
end
Expand Down