Skip to content

GitLab

Trac
Trac

GitLab is used only for code review, issue tracking and project management. Canonical locations for source code are still https://gitweb.torproject.org/ https://git.torproject.org/ and git-rw.torproject.org.

Closed (moved)
Opened by Georg Koppen@gk

Web developer network tab breaks first-party isolation in some cases

There are rare cases where the first-part isolation breaks if the Web developer Network tab is open. This got first reported on our blog: https://blog.torproject.org/blog/tor-browser-65a5-released#comment-224102

Steps to reproduce (works both in the stable and the alpha series on Linux at least):

  1. Start a fresh Tor Browser and set the Torbutton log level to "3"
  2. Open the Network tab in the Web developer console (Ctrl + Shift + Q)
  3. Go to https://torproject.org
  4. Reload the page with the arrow in the URL bar

Result:

Torbutton INFO: tor SOCKS isolation catchall: https://www.torproject.org/images/onion-heart.png via --unknown--:de6a28fb71abeba4febbbdde61de345e

It is actually only the request for the onion heart that is affected. And having the Network tab open is crucial for reproducing the bug.

To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information