Skip to content

Unclear handling of multiple Onion-Location headers

The specification for the Onion-Location header is unclear about two points:

  • How to handle multiple copies of the Onion-Location header.
  • Whether the header or the <meta> tag takes precedence.

Looking at the following test pages:

I found that the Tor Browser merges all header values together (separated by ", " (without the quotes) and uses that as the URL. The <meta> tag takes precedence.

Is that the intended behavior?

I thought that behavior was surprising and I would have expected something like:

  • Only honor the first Location header. Ignore subsequent ones.
  • Treat commas as an allowed character in the URL (like for the Location header).
  • The response header takes precedence over any headers defined in a <meta> tag.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information