search

HelloZeroNet / ZeroNet

ZeroNet - Decentralized websites using Bitcoin crypto and BitTorrent network
https://zeronet.io
Other
18.35k stars 2.27k forks source link

Zeronet UI does not work without HTTP Accept header #1346

Open ValdikSS opened 6 years ago

ValdikSS commented 6 years ago

Step 1: Please describe your environment

Step 2: Describe the problem:

Zeronet Ui expects HTTP Accept header to contain at least text/html. I2P tunnels remove Accept header from the request, which does not allow to access Zeronet due to the following check: https://github.com/HelloZeroNet/ZeroNet/blob/master/src/Ui/UiRequest.py#L283

Steps to reproduce:

  1. Send HTTP request without Accept HTTP header to Zeronet UI address

Observed Results:

Zeronet returns HTTP 403 Invalid Accept header to load wrapper error.

Expected Results:

Zeronet ignores absence of HTTP Accept header and continue to work.

purplesyringa commented 6 years ago

Well, @ValdikSS, this check was added to protect from <img src="/fdgkjdhgjfd"> attack. Normal HTTP requests send text/html as Accept, while img tags don't.

ValdikSS commented 6 years ago

Do I understand this correctly that this is done to prevent deanonymization of Zeronet users from the usual internet websites? If Zeronet would serve the content when Accept header is completely missing, would that bring additional issues?

purplesyringa commented 6 years ago

@ValdikSS Yes, for example, other sites could trigger site download by adding <img src="/Talk.ZeroNetwork.bit/"> tag that will download ZeroTalk.