7

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browser already knows where to send the request the instant you click the link. This is called DNS prefetching.

This behaviour can be disabled by setting the x-dns-prefetch-control HTTP response header to off. I have been recommended to do so "for security reasons", but what I fail to understand is - what adverse security or anonymity implications would allowing DNS prefetching have?

Improve this question

2 Answers 2

Reset to default
4

This could give rise to an information leakage vulnerability.

Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources.

For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique to that page.

With DNS prefetching enabled, a suitably places eavesdropper can infer that a user has a mortgage with that particular bank because when this page is visited DNS requests will be observed to resolve the external resource hosts referenced by that page.

Of course, if the user decides to visit those links manually, the same could be inferred without prefetching in this case. However, with more complex sites there may be unique combinations of resources on different pages giving away to observers which pages on the otherwise private session have been visited.

Whether this is an actual security vulnerability or not depends very much on the context of the website and the placement of links. Another mitigation instead of disabling would be to include all, or a random selection of, external references on every page using the

<link rel="dns-prefetch" href="//example.com" />

directive.

Improve this answer
3
  • Thanks you for your answer! I guess the same would be true even without DNS prefetch if the mortage page uniquely includes images/scripts/styles from another domain? Is this the only security concern involved?
    – Anders
    Commented Apr 29, 2016 at 8:19
  • 1
    Yes, the same would apply for external resources - any unique external resource signatures would have a similar information leak risk. Check here for a few others (related to a malcious webste, not the same as in your case), however from what I can see the same attacks can be acomplished using other means anyway.
    – SilverlightFox
    Commented Apr 29, 2016 at 15:57
  • @SilverlightFox - What do you mean by "With DNS prefetching enabled, a suitably places eavesdropper can infer that a user has a mortgage with that particular bank because when this page is visited DNS requests will be observed to resolve the external resource hosts referenced by that page"? I imagine that the DNS prefetch request is made by the browser client to a DNS server that has been configured on the device. If yes, how does an eavesdropper infer the request?
    – Motivated
    Commented Oct 22, 2019 at 4:37
1

Just came across this in my own research. For posterity, I found this https://blog.compass-security.com/2016/10/bypassing-content-security-policy-with-dns-prefetching/

TLDR; If a site is vulnerable to XSS but has strict Content Security Policy (CSP) which would limit cross-origin fetch requests, DNS preflight can be used to exfiltrate data.

Improve this answer
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Aug 2, 2022 at 7:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .