Two questions about ClientAuthorization (v3)

Question

1. Should the onion server (host) also create an .auth file for itself?

2. Suppose the onion server has authorized a client (i.e. the "authorized_clients" folder contains a ".auth" file. The onion service operator decides to revoke the access, so he deletes the ".auth" authorizer file. However, this assumes that the onion service does NOT disallow the client, but allows ANYONE to access it, doesn't it? Therefore, operators must be careful to create at least two authorizing files, to avoid that when deleting one, access to the site is free, without restrictions.

Answer 1

1. Yes. There are steps that both the client and host have to follow. If you are on the host and start Tor Browser, you probably need to make sure that you are an authorized user. You could always access the site locally with localhost but once you use Tor, you are just another Tor user.

2. See below:

Note that once you’ve configured client authorization, anyone else with the address won’t be able to access it from this point on. If no authorization is configured, the service will be accessible to anyone with the onion address.

So if you have client auth for Larry, Moe, and Curly; no one else can access the onion service. If you remove Curly's access then only Larry and Moe and can access and not Curly. If you remove Larry, Moe, and Curly then client authorization is disabled and anyone can access.

See also tor manual and v3 Specifications.