3

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browser already knows where to send the request the instant you click the link. This is called DNS prefetching.

This behaviour can be disabled by setting the x-dns-prefetch-control HTTP response header to off. I have been recommended to do so "for security reasons", but what I fail to understand is - what adverse security or anonymity implications would allowing DNS prefetching have?

2

This could give rise to an information leakage vulnerability.

Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources.

For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique to that page.

With DNS prefetching enabled, a suitably places eavesdropper can infer that a user has a mortgage with that particular bank because when this page is visited DNS requests will be observed to resolve the external resource hosts referenced by that page.

Of course, if the user decides to visit those links manually, the same could be inferred without prefetching in this case. However, with more complex sites there may be unique combinations of resources on different pages giving away to observers which pages on the otherwise private session have been visited.

Whether this is an actual security vulnerability or not depends very much on the context of the website and the placement of links. Another mitigation instead of disabling would be to include all, or a random selection of, external references on every page using the

<link rel="dns-prefetch" href="//example.com" />

directive.

  • Thanks you for your answer! I guess the same would be true even without DNS prefetch if the mortage page uniquely includes images/scripts/styles from another domain? Is this the only security concern involved? – Anders Apr 29 '16 at 8:19
  • 1
    Yes, the same would apply for external resources - any unique external resource signatures would have a similar information leak risk. Check here for a few others (related to a malcious webste, not the same as in your case), however from what I can see the same attacks can be acomplished using other means anyway. – SilverlightFox Apr 29 '16 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.