After logging in via .onion, the user is redirected back to the ‘clearnet’ domain.
I realise it’s a security fix, but in some jurisdictions, redirecting the user away from the Tor network could place them in danger. I know it’s a niche thing to be concerned about, but the danger is very real for some people.
Is there any way Discourse can accept a whitelist of domains to be used on as opposed to just one? The way it was worked without a problem for hosting Discourse on a clear net domain as well as an .onion alternative, until now.
The Tor network supports carrying traffic to “clearnet” sites, not just sites that are specifically hosted on onion domains. Onion services are only needed if the host of the forum themselves wants to be anonymous, in which case you wouldn’t have a clearnet domain.
Fundamentally the problem is we expect Discourse sites just to have 1 domain. The reason for this is that we send out emails and have to pick a domain we can not pick random.
I am not following why not have the onion address as your hostname.
If you really really want to enable this ninja I am allowed to have 2 domains going feature, you can use a plugin, example of a commit that made this work for my blog is here:
In our use case we want to support both an .onion and a clearnet domain as options for our users.
The previous reply has overlooked other benefits of .onion than just anonymity, as well as the fact that Tor’s support for accessing clearnet sites introduces other risks by requiring exit nodes (unlike .onions) so is not sufficient on its own, but I don’t want to get into a big discussion here on the merits/disadvantages, I’m not here to convince anyone of why.
Other popular opensource apps such as Phabricator, Drupal, etc, all support methods with which to ‘whitelist’ multiple valid domain names for the app, even if one is considered the ‘primary’ for purposes such as sending mail, and still preventing cache poisoning attacks etc via invalid domains. I had hoped Discourse could do the same, but I’m satisfied with a plugin solution for our very corner-case requirement. Thanks again!
