0

.onion websites don’t need HTTPS because Tor hidden service provides defense against man-in-the-middle attacks.

Yet, it seems that .onion websites without https are not able to persist cookies which makes then unusable.

I have the latest version and tested default install and with:

  1. Marking as temporary trusted
  2. Adding the Allow list in Preference-> Content blocking
  3. HTTPS websites that have a self-signed SSL

In all cases the developers console (press Control + Alt + i) shows that all “storage” was blocked for the website

Request to access cookie or storage on “http://xyz.onion/” was blocked because we are blocking all storage access requests. learn more

developer console

2
  • Tor Browser is designed to store cookies for the session only, and then will clear them when you close the browser. You shouldn't need to change any settings for this. Is the browser not storing any cookies, even for the current session? If so, can you post an example website where this happens?
    – Steve
    Jan 17 at 20:17
  • yes, cookies get dropped even for current session. For example answerszuvs3gg2l64e6hmnryudl5zgrmwm3vh65hzszdghblddvfiqd.onion/… Jan 18 at 13:05
1

I had some local settings that caused this issue.

Solved it by removing local setting folder (on Mac):

sudo mv ~/Library/Application\ Support/TorBrowser-Data ~/Library/Application\ Support/TorBrowser-Data-achive-2021-01-18

I suspect it was caused by "HTTPS Everywhere" or "No Script plugin". Strangely disabling them did not fix the issue. And "HTTPS Everywhere" could not be deleted thru the browser extensions manager.

https://www.eff.org/https-everywhere

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.