Unclear handling of multiple Onion-Location headers
The specification for the Onion-Location header is unclear about two points:
- How to handle multiple copies of the
Onion-Locationheader. - Whether the header or the
<meta>tag takes precedence.
Looking at the following test pages:
I found that the Tor Browser merges all header values together (separated by ", " (without the quotes) and uses that as the URL. The <meta> tag takes precedence.
Is that the intended behavior?
I thought that behavior was surprising and I would have expected something like:
- Only honor the first
Locationheader. Ignore subsequent ones. - Treat commas as an allowed character in the URL (like for the
Locationheader). - The response header takes precedence over any headers defined in a
<meta>tag.