keybase / keybase/keybase-issues

EFF Privacy Badger blocks keybase.io for CORS in Chrome

Open
#1,758 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I'm not sure who's problem this is. It could be just Privacy Badger complaining about using AWS to host content.

Steps to Reproduce

1) Install EFF Privacy Badger (https://www.eff.org/privacybadger) in Chromium on Ubuntu. Default settings for do not track.
2) Use CORS with code something like this:
/**
\* Keybase URL when used with CORS.
*/
var CORS_URL = "https://keybase.io/_/api/1.0/";

```
/**
* @summary Make CORS request object.
* @description Cross browser handler for CORS requests.
* @param {string} method the type of request to be made
* @param {string} url the URL for the request
* @returns {object} the CORS capable object or null if the browser doesn't support CORS.
* @function createCORSRequest
* @memberOf module:keybase
*/
function createCORSRequest (method, url)
{
var ret;

ret = new XMLHttpRequest ();
if ("withCredentials" in ret) // "withCredentials" only exists on XMLHTTPRequest2 objects
ret.open (method, url, true);
else if ("undefined" != typeof (XDomainRequest)) // XDomainRequest only in IE
{
ret = new XDomainRequest ();
ret.open (method, url);
}
else // CORS is not supported
ret = null;

return (ret);
}

/**
* @summary Lookup someone in Keybase.
* @description Tries to get information about the username.
* @param {string} username the user to look up in Keybase
* @param {object} options callback functions for success() and error(),
* success function passed the lookup results
* @function lookup
* @memberOf module:keybase
*/
function lookup (username, options)
{
var url;
var xmlhttp;

options = options || {};
url = CORS_URL + "user/lookup.json" + "?usernames=" + username;
xmlhttp = createCORSRequest('GET', url);
if (null === xmlhttp)
{
// fall back to non-CORS assuming an appropriate proxy is set up
url = URL + "user/lookup.json" + "?usernames=" + username;
xmlhttp = new XMLHttpRequest ();
xmlhttp.open ("GET", url, true);
}
xmlhttp.onreadystatechange = function ()
{
if (4 == xmlhttp.readyState)
if (200 == xmlhttp.status)
{
if (options.success)
options.success (JSON.parse (xmlhttp.responseText));
}
else
if (options.error)
options.error ();
};
xmlhttp.send ();
}
```

Result:

Message in console:
GET https://keybase.io/_/api/1.0/user/lookup.json?usernames=derrickoswald net::ERR_BLOCKED_BY_CLIENT

Privacy Badger UI says that this tracker (keybase.io) is blocked.

Workaround:

1) Use Firefox
or
2) Disable Privacy Badger for the site that is using CORS to access keybase.io.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the JavaScript CORS_URL, createCORSRequest, and lookup functions, then reproduce the request in Chromium with Privacy Badger enabled. Compare the blocked keybase.io request with the Firefox and disabled-extension workarounds; done means determining whether the Keybase client or website has an actionable change, or documenting that the block is external.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.