HTTP Onion Header ignored for local install

I have BTCPay Server installed on a rockpro64.

When opening it via Brave, with local ip or local domain, I don’t see the Open in Tor option in brave. This might come from the fact the page is not https.

But this is problematic, because there is no easy way to discover the onion address of your install outside going to server settings / services.

Maybe we should add again the Tor link in the login page… That said, it seems to happen only if it is opened on HTTP. To make sure we don’t get black listed again by google safe browsing, maybe we should show the Tor link on login page only if http.

[dennisreimann]

In the design meeting I think we already decided to re-add the button once we get to rework the footer. So we are in good shape, just need to find the time to implement it 😃

[dennisreimann]

Some more context, as I started to look into this a bit and the references might be helpful …

At least from our general Tor checks it seems we do not exclude the Onion-Location header when using http.

The docs state this, which explains why the button isn’t displayed:

The webpage defining the Onion-Location header must be served over HTTPS.

So this is indeed the problem and we need to fix it on our end to solve this. Unfortunately we never clearly found out where the safe browsing issue came from. Nevertheless the first pass of trying, which removed the Tor link from the login page, did not resolve the issue. So, having the link on the login page might actually solve this one without bringing back the safe browsing problem.