[Solved] block tor2web
Added by dlnviyno over 8 years ago
Hello,
I'm serving a website with lighttpd through a tor hidden service and was wondering if it's possible to block access to the website from Tor2web-proxies (like .to, .city,...) to protect the privacy of the visitors by forcing them to use a tor browser instead of tor2web?
The request header
2016-09-07 09:12:46: (request.c.311) fd: 8 request-len: 401 \nGET /avatar.png HTTP/1.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, chunked\r\nX-Forwarded-Host: abcdefghijklmnop.onion.to\r\nX-Tor2web: 1\r\nConnection: keep-alive\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nUser-Agent: Mozilla/4.9 (X10; Mint; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/47.0\r\nDNT: 1\r\nHost: abcdefghijklmnop.onion\r\nX-Forwarded-Proto: https\r\n\r\n
of a Tor2web-proxy (.to in this case) contains "X-Tor2web" but I can't find a way (or maybe this isn't even possible with lighttpd) to block requests that contain "X-Tor2web" in the header with something similar to putting
- deny access for all googlebot
$HTTP["useragent"] =~ "Google" {
url.access-deny = ( "" )
}
in lighttpd.conf.
Replies (3)
RE: block tor2web - Added by gstrauss over 8 years ago
While lighttpd config does not currently allow tests against arbitrary request headers, mod_magnet does allow this.
See https://redmine.lighttpd.net/projects/lighttpd/repository/revisions/779c133c16f9af168b004dce7a2a64f16c1cb3a4 example of creating /path/to/deny-proxy.lua. In your case, you want something like
if (lighty.request["X-Tor2web"] == nil) then return 0 else return 403 end
though you probably want to return something other than 403, e.g. a page with instructions how to use a tor browser.
Lots more info about lua in lighttpd can be found at https://redmine.lighttpd.net/projects/lighttpd/wiki/AbsoLUAtion
[edit: changed to == nil, from != nil as noted in comment below]
RE: block tor2web - Added by dlnviyno over 8 years ago
Implemented with mod_magnet and lua (changed != to == in the statement to get desired outcome).
Thank you
RE: [Solved] block tor2web - Added by gstrauss about 8 years ago
FYI: next version of lighttpd (lighttpd 1.4.46) will support $REQUEST_HEADER["..."] for config conditions against arbitrary request headers.