[Broken Website] Transmission web interface

Broken Website Report

Website Address

Transmission web interface (https://transmissionbt.com/)

Steps To Reproduce

• Spawn a Transmission daemon with web interface activated (i.e: https://docs.linuxserver.io/images/docker-transmission)
• Go to the webpage
• You will need to add a torrent to use the right click

Problematic Observation

DarkReader prevents loading some of the resources (Some are also due to a Transmission bug I’m on my way to report too)

Screenshots

System Information

• OS: Windows
• Browser: Version 107.0.5304.122 (Official Build) (64-bit)
• Dark Reader Version: 4.9.60

Additional Context

I investigated a little (I have some JS/TS basics) and found that the extension does not send the Authorization: Bearer {{ TOKEN }} header. I found a fix that works for me but don’t know if there is security issues with it or even if it breaks any thing else src/utils/network.ts#8 credentials: 'omit', → credentials: 'same-origin'

[Gusted]

I investigated a little (I have some JS/TS basics) and found that the extension does not send the Authorization: Bearer {{ TOKEN }} header. I found a fix that works for me but don’t know if there is security issues with it or even if it breaks any thing else src/utils/network.ts#8 credentials: 'omit', → credentials: 'same-origin'

Oh, that’s quite weird. I don’t know why you would put assets behind a authorization wall… Dark Reader is dealing with user-given URL input, it’s a better safe than sorry to not send any credentials.

[bershanskiy]

Transmission might be locking out assets behind authorization to prevent other origins from dumb port-scanning in an attempt to discover transmission installations. In theory, web UI may be accessible remotely (one of explicitly supported features) so if assets did not require authentication, one could trivially discover reachable Transmission installs, likely including Transmission version.

I don’t use Transmission, so the following question may be silly: does Transmission have a native dark mode? If Transmission is the only application requiring auth like this and does not change UI frequently, it might be better to simply use Dark Reader generate the theme once and then upstream it (not requiring Dark Reader). Of course, this won’t allow you to use custom Dark Reader configs, time automation, etc.