3

If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?:

<link rel="dns-prefetch" href="http://www.spreadfirefox.com/">

I know Firefox and Chromium respect this header, but I'm not sure if Chrome does as well.

I'm asking because I would like to disable DNS prefetching on certain secure pages on my website to protect against this kind of vulnerability: https://blog.compass-security.com/2016/10/bypassing-content-security-policy-with-dns-prefetching/

1
  • 1
    This doc says yes, but I can't promise it's authoritative.
    – Kevin
    Commented Feb 21, 2018 at 5:22

2 Answers 2

1

The X-DNS-Prefetch-Control HTTP response header controls DNS-prefetching of <a href> elements on hover. It has nothing to do with <link rel="dns-prefetch"> mechanism.

1
0

Answering my own question after some experimentation:

My page contains a link that does DNS prefetching to an arbitrary domain:

<head>
<meta charset="utf-8" />
<link rel="dns-prefetch" href="http://aaaaaaaaaaa@(new Random().Next(11111)).ba@(new Random().Next(11111)).com">

I set the X-DNS-Prefetch-Control header to "off" and added a <meta> tag to be extra safe:

Http header and meta tag

Unfortunately chrome still does a DNS call to that domain, even with a strict Content Security Policy.

enter image description here

My page's content security policy that does not allow calls to any external domains:

Content-Security-Policy:default-src 'self'; img-src 'self'; form-action 'self';

So it seems like Chrome does not respect the X-DNS-Prefetch-Control header. I'm using Chrome v64.0.3282.167

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .