0

In the URL bar of tor-browser, go to about:config.

In the page of about:config, find Network.http.sendRefererHeader then change the value to 1.

Any risk?

0

This image shows what Network.http.sendRefererHeader does:

enter image description here

The Tor browser has set Network.http.sendRefererHeader to 2 by default so it is allowing all requests. So by changing it, you will obviously have a different browser fingerprint and you can easily be identified (you would be the only Tor browser user who is blocking requests). The Tor Browser's settings are already the best they can be so I wouldn't recommend changing this.

Also, the Tor browser makes Network.http.sendRefererHeader to 2 by default because there really is no need to block requests as seen here:

When leaving a .onion domain we set the Referer header to an empty string by providing a preference, network.http.referer.hideOnionSource, and setting it to true. That avoids leaking information which might be especially problematic in the case of transitioning from a .onion domain to one reached over clearnet.

Apart from that we haven't disabled or restricted the Referer ourselves because of the non-trivial number of sites that rely on the Referer header to "authenticate" image requests and deep-link navigation on their sites. Furthermore, there seems to be no real privacy benefit to taking this action by itself in a vacuum, because many sites have begun encoding Referer URL information into GET parameters when they need it to cross HTTP to HTTPS scheme transitions. Google's +1 buttons are the best example of this activity.

Quote source: https://2019.www.torproject.org/projects/torbrowser/design/

Image source: https://wiki.mozilla.org/Security/Referrer

4
  • Tor developers must have a bigger reason to design tor-browser to send HTTP Referer by default, because setting the default value to 1 for all looks easy for the Tor developers.
    – torbnnxx
    Apr 15 at 12:30
  • @torbnxx yes, there is another reason I just added which I forgot to mention.
    – Swangie
    Apr 15 at 23:03
  • @torbnnxx, please the read the quote I added. Blocking the HTTP referer requests are pointless because sites can just encode the Referer URL information into GET parameters when they need it to cross HTTP to HTTPS scheme transitions. So there really should be no reason to block these requests and I hope you understand why now.
    – Swangie
    Apr 15 at 23:09
  • Thank you, you should be voted up.
    – torbnnxx
    Apr 16 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.