In the current versions of Tor (4.5.1) every time a new tab is opened a new circuit is made - causing the ip to change.
Consider the following scenarion:
- User logs into firstsite.com - session/cookie data stores originating IP address among other credentials
- User clicks on link at firstsite.com to access secondsite.com
- firstsite.com sends IP address along with other credentials to secondsite.com
- Authentication fails at secondsite.com because a new circuit has been formed in the new tab and the IP's no longer match.
I have tried TrackHostExits, MaxCircuitDirtiness, NewCircuitPeriod. Is there any way to keep the same circuit across an entire browser session?