3

When a webserver runs behind a hidden service, can it serve multiple HTTP requests at the same time, or will it only be able to handle one request at a time?

4

Webservers generally accept many simultaneous connections, and process many requests simultaneously. As Peter Palfrader aka weasel notes in his answer, the Tor hidden service protocol can also handle multiple simultaneous connections.

Users see the webserver's public hostname, and connect via Tor circuits. The webserver sees users coming from virtual ports on the Tor gateway. But they're all routed through one reverse proxy, so there is a throughput bottleneck.

[This space is available for someone who can explain workarounds.]

Make sure that your server is well secured. If you need remote ssh and sftp, disable password-based login and and root login, and allow only id_rsa.pub-based login by user. Also, stick to static html unless you know php and mysql well. Vulnerabilities in php and mysql are the major holes when remote login is secured.

If you're just learning, it may be best to start with thttpd. It's a very simple and secure (with small attack surface) webserver. And it also "has one extremely useful feature (URL-traffic-based throttling) that no other server currently has".

  • But the webserver is connected to Tor reverse proxy using only a single connection, so how can it receive two (or more) incoming connections simultanously? – Muis Oct 18 '13 at 3:18
  • The webserver does indeed use a single connection. But its users are connecting through Tor circuits that are routed through that connection. The webserver sees users coming from virtual ports on the Tor gateway. However, although the webserver can accept multiple connections simultaneously, there is a throughput bottleneck. I suspect that there are workarounds. – mirimir Oct 18 '13 at 7:45
  • While there may be workarounds, I'd bet that they are unnecessary; I maintained 50k pageviews per day for a week without doing anything strange with Tor; the hidden service will adapt it's introduction points to handle expected traffic levels and the actual tor software can handle a fairly heavy load. – IceyEC Oct 24 '13 at 15:53
  • @mirimir Do you have any source for this? Because since its tunneling traffic to the webserver using a single port, I cannot imagine a way how it could technically pass two requests simultanously to the webserver? And yes it may be overkill for 99% of the websites, since the chance of two requests coming in at the same time is virtually zero, but this is just a technical question. – Muis Dec 26 '13 at 16:24
2

A hidden service can handle multiple connections at a time. Thus, your webserver should be able to handle multiple requests at a time.

  • Do you have any source for this? Because since its tunneling traffic to the webserver using a single port, I cannot imagine a way how it could technically pass two requests simultanously to the webserver? – Muis Dec 26 '13 at 16:22
  • The server only has a single port. Your tor process running the hidden service connects to the server using a variety of different source ports. Just like with any other tcp server elsewhere. – weasel - Peter Palfrader Dec 27 '13 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.