Unclear handling of multiple Onion-Location headers
The specification for the Onion-Location
header is unclear about two points:
- How to handle multiple copies of the
Onion-Location
header. - Whether the header or the
<meta>
tag takes precedence.
Looking at the following test pages:
I found that the Tor Browser merges all header values together (separated by ", "
(without the quotes) and uses that as the URL. The <meta>
tag takes precedence.
Is that the intended behavior?
I thought that behavior was surprising and I would have expected something like:
- Only honor the first
Location
header. Ignore subsequent ones. - Treat commas as an allowed character in the URL (like for the
Location
header). - The response header takes precedence over any headers defined in a
<meta>
tag.