Comments (5)
If I understand your issue correctly, it sounds like this is because the public-key-pins
header is being forwarded to the client by eotk
when it might be more useful to avoid doing that.
Looks to me like adding either:
proxy_hide_header public-key-pins;
or
more_clear_headers "public-key-pins";
to the server{ }
directive of the nginx.conf
template should fix the issue as then the HPKP header won't be forwarded to users arriving via .onion
There's probably a good argument for masking the Strict-Transport-Security
header in the same way too, but I'll see what @alecmuffett thinks.
from eotk.
@sainslie I think this is a pointer to me needing to write actual documentation; I already have a couple of switchables:
set header_csp_suppress 1
set header_hsts_suppress 1
...but maybe the HSTS one (at least) should be default-on, and @ajhaydock has (I think) spotted a deficiency in the existing code, re the *pins
headers
Also, maybe CSP should be rewritten using Lua, not nuked?
from eotk.
CSP is an interesting one. I probably wouldn't nuke it completely like the HSTS/HPKP headers, but rewriting it might be a good idea.
Letting CSP headers pass through unedited might cause issues if we want to present the client with an onion served over regular HTTP, and the site admin has decided to use something like img-src https:
in the CSP, which would allow for the loading of image content from any domain, but only over HTTPS.
I don't know how common that sort of policy is, but I've used that particular directive myself before to allow for image embedding and hyperlink thumbnails on a forum-style site (but without allowing the site to serve mixed-content which would result in a yellow HTTPS warning triangle in the client's browser).
from eotk.
@sainslie - check the new code :-)
from eotk.
Bump? I plan to close this tomorrow if no further input?
from eotk.
Related Issues (20)
- .
- error: the only supported value for ONION_VERSION is 3 HOT 4
- Installing SSL certificate with eotk for an existing onion address and server with Caddy docker HOT 5
- Ok HOT 1
- Could not resolve hostname wolfgang HOT 1
- eotk genkey fails with newer Tor version HOT 3
- Globally tweak nginx.conf files HOT 1
- deal with Timing-Allow-Origin in header rewrites HOT 1
- redirect_host is rewriting the URL to redirect to HOT 1
- Could not generate website HOT 1
- only http modus? HOT 2
- Log files with origin domains HOT 1
- 'resty.core' on Rasbian Stretch HOT 4
- Cannot prevent a subdomain from being unonionized HOT 3
- Create a debug-dump endpoint, optionally enable-able HOT 1
- Deployment of EOTK on Free Software Foundation Europe HOT 3
- SSL for production question HOT 19
- Request To fix Typo and Broken link HOT 2
- Overhaul the SSL_proof mechanism to include endpoints irrespective of HTTPS
- Question about using multiple certificates with subdomains HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from eotk.