Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Prevent tracking via alternative services (`Alt-Svc` header)

See original GitHub issue

alt-svc by default have a 24 hour lifetime, which can be modified with the ma option.

This can be used for tracking, in a similar way to HSTS cookies.

My initial best guess is that the safest option is to never cache alt-svc values

Issue Analytics

State:
Created 4 years ago
Comments:6 (6 by maintainers)

Top GitHub Comments

1reaction

pes10kcommented, Oct 19, 2021

closing this bc it’ll be solved by enabling NetworIsolationKey for all users (already being rolled out on nightly and beta)

0reactions

fmariercommented, Mar 19, 2020

QUIC will be enabled by default in Chromium 83: https://groups.google.com/a/chromium.org/d/topic/chromium-dev/JjKJ28aDLxg/discussion

Top Results From Across the Web

Alternative (ab)uses for HTTP Alternative Services - USENIX

In this work, we present yet another technique for user tracking using the Alt-Svc header. Our techniques bypass third-party tracker blocking options instituted ......

Alt-Svc - HTTP - MDN Web Docs

The Alt-Svc HTTP header allows a server to indicate that another network location (the "alternative service") can be treated as ...

RFC 7838: HTTP Alternative Services

The Alt-Svc HTTP Header Field An HTTP(S) origin server can advertise the availability of alternative services to clients by adding an Alt-Svc header...

Header aches in Firefox, Tor, Brave and Chrome as HTTP ...

The HTTP Alternative Services header can be abused to conduct network reconnaissance and attacks, to bypass malware protection services, ...

The Evil Alt-Ego: (ab)using HTTP Alternative Services - YouTube

The HTTP Alternative Services header ( Alt-Svc, RFC 7838) was introduced in 2013 by seasoned developers with good intentions in a bid to ......