16

The Mozilla Foundation has a "privacy browser" called Firefox Focus that is available for example iPhone (here). This browser has an always-on ad blocking function.

I was checking the third-party licenses used by this iPhone version (image shown below) and noticed that it includes the use of GCDWebServer.

3rd-party licenses used by Firefox Focus

The GitHub page for GCDWebServer says that:

GCDWebServer is a modern and lightweight GCD based HTTP 1.1 server designed to be embedded in iOS, macOS & tvOS apps.

There is a support information for this browser here but the documentation does not mention the use of an internal web server.

This issue has relevance in evaluating the risks from possible open ports in connection with determining whether to allow this browser in corporate bring-your-own-device configuration.

Question: What use would a mobile device web browser have for running an embedded web server?

Improve this question
1
  • 4
    Currently it is not clear for me how this question (use of embedded web server inside a browser) is about information security. If you feel that this is on-topic please adjust your question to explain this, otherwise it likely will be seen as off-topic and get closed. Note that it is not on-topic just because the server is used in a privacy-focused browser.
    – Steffen Ullrich
    Commented Dec 26, 2019 at 17:33

3 Answers 3

Reset to default
38

One thing Firefox Focus uses this embedded web server for is to detect whether Safari Content Blocking rules were successfully enabled. It seems from this answer and the Focus source code that iOS 10 provides an API for determining whether a Safari Content Blocking extension is enabled, but that in iOS 9 there wasn't such an API. Instead, it was necessary to actually try making a request to detect whether that request was blocked; if blocked, you then assume the blocker is working. I'm guessing that a decision was made to spin up a local web server as the target for the blocker detection test so as not to rely on a remote service, which would have introduced reliability and privacy issues.

Improve this answer
8

Not sure whether Firefox Focus actually does this, but some mobile adblockers have a built-in internal web server which answers requests by serving empty content (zero byte text files, 1x1 GIFs, etc). The adblocker redirects blocked requests to this internal server. This generally results in rendered web pages showing nothing instead of the ad, whereas without the internal web server an error message might appear instead of the ad.

Improve this answer
-1

Internal pages — The settings pages, for example. Why rewrite all the functionality to implement those when you can just make use of an existing tool?

Improve this answer
1
  • 3
    I think about: and config: URIs are special, and are handled without making an actual HTTP request. file:// URLs can just load the file, for example, they don't need to serve it to the browser of HTTP. So multiple transports are already supported, and hooking the config internal pages into that makes more sense than writing them as web services where the user has to actually submit forms.
    – Peter Cordes
    Commented Dec 28, 2019 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .