search

ooni / backend

Everything related to OONI backend infrastructure: ooni/api, ooni/pipeline, ooni/sysadmin, collector, bouncers and test-helpers
BSD 3-Clause "New" or "Revised" License
49 stars 29 forks source link

Consider alternative query string parameter that does not encode domain name in URL #885

Open rocodes opened 2 weeks ago

rocodes commented 2 weeks ago

Dear OONI team - thank you for all your work on this project.

I am wondering if it would be possible to offer a uuid-based query string parameter in place of (or in addition to, for backwards-compatibility) the domain URL.

Rationale: In some cases, attempting to share a link to OONI probe results can result in the ooni explorer URL itself being blocked/unshareable on certain platforms, because if censorship is being done by domain string matching, the ooni URL contains the target string. The current workaround is to generate and share a short link via a link shortener.

# Current 
https://explorer.ooni.org/chart/mat?since=2024-08-24&until=2024-09-24&time_grain=day&axis_x=measurement_start_day&test_name=web_connectivity&domain=$BLOCKED_DOMAIN  # Trying to share this link can cause problems

# Proposed
https://explorer.ooni.org/chart/mat?since=2024-08-24&until=2024-09-24&time_grain=day&axis_x=measurement_start_day&test_name=web_connectivity&domain=$UUID

Hope I filed this in the right place; happy to answer questions or assist if I can.

rocodes commented 2 weeks ago

(Also, maybe this isn't the solution, eg maybe putting the domain in the request body is an option - but hopefully have explained the problem moreso than presumed the solution :) )

hellais commented 1 week ago

Thanks for reporting this.

You mention:

if censorship is being done by domain string matching, the ooni URL contains the target string.

How is this possible? The HTTP request, including the HTTP request line that contains the request path, are going to be going over HTTPS so it's not possible for a censor to determine the value of the domain in the request.