Krinkle
commented
10 months ago The https://releases.jquery.com domain and legacy https://codeorigin.jquery.com domain have been switched over to Fastly.
I don't run a Tor exit node myself, but as I understand it, merely using Tor would make my IP address (from the POV of the server) will effectively be that of the exit node part of the chain for my Tor session. As long as I pick a chain that has an exit node with an uptime of more than 10 days, that's presumably enough time for any WAF blocks to come into effect.
I tested the following URLs:
- https://releases.jquery.com/jquery/
- https://code.jquery.com/jquery-3.7.1.min.js
- https://code.jquery.com/mobile/1.4.0/images/icons-png/eye-black.png
- https://codeorigin.jquery.com/jquery-3.7.1.min.js
- https://codeorigin.jquery.com/mobile/1.4.0/images/icons-png/eye-black.png
And to check the exit node and uptime, I used https://check.torproject.org/.
I tested it through three different chains. In all three cases, none of the requests timed out failed or failed in any way. Both through Fastly and through StackPath.
- uptime: 8 days.
- uptime: 69 days.
- uptime: 43 days.
We have received anecdotal reports from jQuery CDN users that StackPath/Highwinds may be blocking Tor clients.
It is not uncommon for CDN providers to offer WAF protection to avoid abuse, e.g. when serving a blog open to comments, or some other kind of dynamic service with an abuse vector. I'm guessing Highwinds has a blocklist of sorts that includes IPs of customers who happen to run Tor relays at home.
I was not able to find any kind of WAF or traffic filtering rules in Highwinds StrikeTracker, nor could I find anything about it in the Highwinds StrikeTracker support pages. However, the general StackPath support pages do mention their WAF service, and indeed that offers a preset for TOR exit nodes. I'm guessing a version of this rule is implicitly turned on for Highwinds, without any ability to turn off, or at least not in a way we can control ourselves.
https://support.stackpath.com/hc/en-us/articles/360001091666-Review-and-Allowlist-CDN-WAF-IP-Blocks
Depending on the timeline for switching from StackPath Highwinds to Fastly, it might not be worth escalating with StackPath. Instead, we can make sure that post-switch we can check and make sure Fastly does not block access to jQuery CDN from home IPs that use Tor.
Ref https://github.com/jquery/codeorigin.jquery.com/issues/95, \cc @vincejv.