diff --git a/browser/app/profile/001-base-profile.js b/browser/app/profile/001-base-profile.js index a6fa885a4bbdfc614ce3244c51a3063f0661b16c..b1e7bb02f9db1c8fe1265ed1a95620b03088dc52 100644 --- a/browser/app/profile/001-base-profile.js +++ b/browser/app/profile/001-base-profile.js @@ -68,6 +68,12 @@ pref("browser.pagethumbnails.capturing_disabled", true); pref("dom.security.https_only_mode", true); pref("dom.security.https_only_mode_pbm", true); +// tor-browser#22320: Hide referer when comming from a .onion address +// We enable this here (rather than in Tor Browser) in case users of other +// base-browser derived browsers configure it to use a system Tor daemon +// to visit onion services. +pref("network.http.referer.hideOnionSource", true); + // Require Safe Negotiation ( https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27719 ) // Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a // MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations