Omit referrers on cross-origin requests from an .onion address

[fmarier]

This is to address #155.

---

Preview | Diff

[annevk]

whatwg/fetch#1351 proposes similar language. Do we expect many other places to need this? If we find a third it probably warrants abstraction.

[fmarier]

Do we expect many other places to need this? If we find a third it probably warrants abstraction.

The only other special treatment of .onion I could see in Firefox has to do with treating .onion services over HTTP as a secure context, which we are also planning to do in Brave.

[domfarolino]

This has been sitting for a while now with no activity (partially because I've failed to review it, but that's mostly because I haven't seen much activity in terms of consensus on the other related issues). I've tried to round up all of the related web platform .onion issues and PRs:

• Send "null" Origin headers on cross-origin requests from an RFC7686 address whatwg/fetch#1350
• Omit referrers on cross-origin requests from an RFC7686 address #155
• Send "null" Origin header on cross-origin .onion requests whatwg/fetch#1351
• [hackerone] Strip referrer and origin in cross-origin requests from a .onion origin brave/brave-browser#18071
• (This PR)
• https://bugzilla.mozilla.org/show_bug.cgi?id=1742784

It seems like the Fetch issue is stalled on feedback that hasn't come in, and perhaps also stalled on general consensus for this from other browsers. Would you mind if I closed this or marked it as a draft until some of the consensus around handling .onion in web specs gets sorted out, and we can go from there? Let me know if you have plans to still work on this.

[fmarier]

You can also add brave/brave-browser#18071 if you want (that's the Brave issue where we implemented this in order to match the Tor Browser behavior).

Marking it as draft makes sense. I do intend to pick this up again since I think it would be worthwhile to agree on what the correct behavior should be and/or standardize what the two browser with built-in support for Tor already ship.

[domfarolino]

(This is showing up in my active review requests on GitHub, so I'll remove myself for now while this is parked as a draft)