If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?:

<link rel="dns-prefetch" href="http://www.spreadfirefox.com/">

I know Firefox and Chromium respect this header, but I'm not sure if Chrome does as well.

I'm asking because I would like to disable DNS prefetching on certain secure pages on my website to protect against this kind of vulnerability: https://blog.compass-security.com/2016/10/bypassing-content-security-policy-with-dns-prefetching/

  • 1
    This doc says yes, but I can't promise it's authoritative. – Kevin Feb 21 '18 at 5:22

The X-DNS-Prefetch-Control HTTP response header controls DNS-prefetching of <a href> elements on hover. It has nothing to do with <link rel="dns-prefetch"> mechanism.

| improve this answer | |

Answering my own question after some experimentation:

My page contains a link that does DNS prefetching to an arbitrary domain:

<meta charset="utf-8" />
<link rel="dns-prefetch" href="http://aaaaaaaaaaa@(new Random().Next(11111)).ba@(new Random().Next(11111)).com">

I set the X-DNS-Prefetch-Control header to "off" and added a <meta> tag to be extra safe:

Http header and meta tag

Unfortunately chrome still does a DNS call to that domain, even with a strict Content Security Policy.

enter image description here

My page's content security policy that does not allow calls to any external domains:

Content-Security-Policy:default-src 'self'; img-src 'self'; form-action 'self';

So it seems like Chrome does not respect the X-DNS-Prefetch-Control header. I'm using Chrome v64.0.3282.167

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.