Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
Hi I'm doing some web development and wanted to be able to do some cross browser testing. Normally I would just point which ever browser I'm using at localhost and go from there.
Unfortunately Tor Browser seems to be unable to reach the address. I don't want to expose any unfinished work to the public internet and prefer the convenience of working locally. Any suggestions?
You could set up an onion service with HiddenServiceAuthorizeClient, that would allow you, and only you, to access localhost resources through Tor Browser without any modifications or special settings. This is the least likely to fail catastrophically.
If and only if you are going to use it to view purely localhost content (e.g. you don't reference external resources on the site) then you might try this:
Set aside a distinct and clearly marked copy of Tor Browser then follow this guide to use Tor Browser with an upstream transproxy, this will make Tor Browser disable its own proxying and just connect directly. You can skip the bits about the control port and ignore the Tor Button errors since you're not using Tor at all.
I cannot stress enough just how important it is that you do not allow those environment variables to affect (infect?) any copy of Tor Browser you intend to use for actual browsing. Possibly you want to do this from a computer that is totally disconnected from the network, to be certain.
By far the easiest and safest is to start a local .onion service, then connect to it normally.
Create an empty folder somewhere, e.g. C:/my/keys/test1
Then add this to torrc:
HiddenServiceDir C:/my/keys/test1
HiddenServiceVersion 3
HiddenServicePort 80 127.0.0.1:80
On Windows, torrc is at %USERPROFILE%\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\
Now restart your Tor Browser, and it'll create a file C:/my/keys/test1/hostname, which will contain the .onion address pointing to your localhost:80
Go to about:config and set network.proxy.allow_hijacking_localhost = false.
This stops http[s]://127.0.0.1 from being proxied through Tor. But make sure to request the IP, not by localhost or another hostname, as the browser my still try to DNS-resolve those through Tor and fail.
Alternatively, you can set a whitelist via e.g. network.proxy.no_proxies_on = "127.0.0.1,192.168.1.1".
If these measures don't work, also try to disable the NoScript extension at about:addons. Finally, needless to say that tampering with your proxy and security settings should only be for testing as it may compromise your anonymity.
Further info: As said above, if you want to access pages on your local network via the Tor Browser you can't by default - why not, and why it isn't an option in the main configuration, is beyond me!
How to Fix:
Note: 192.168.0.0/24 - will disable Tor assuming the local IP addresses assigned by your router are of the form 192.168.0.x If this is not the case you will need to swap this value for the one your router does provide, eg: If 192.168.1.x then 192.168.1.0/24, and so on. Do take care not to get cute and try to expand the range too much. Any address you 'disable' is disabled everywhere.
P.S. As a point of security most/many routers assign LAN addresses in the form 192.168.0.x or 192.168.1.x The result is 'naughty' software looks for these IP addresses when trying to do 'naughty' things. It's not a bad idea at all to reconfigure your router for another less commonly used address range, eg: 10.55.101.x or whatever, and if possible set it to automatically reboot once a week at a time when a reboot won't matter.
