How does my browser detect my location even via proxy?

I have tried this code via VPN and got the same result as without it. According to the specification my browser should detect it from:

Common sources of location information include Global Positioning System (GPS) and location inferred from network signals such as IP address, RFID, WiFi and Bluetooth MAC addresses, and GSM/CDMA cell IDs, as well as user input.

So, I proxied my IP. I have no GPS on my PC and do not use WiFi or GSM either. How did this happen? Note that it is accurate to the street.

  • 2
    There's always your local timezone. Your browser knows that. It gives no information about your latitude, but it does put your longitude inside a fairly narrow range. Plus, some timezones touch only one or a few countries, so that nails it down as long as it is assumed you are not at sea. – Celada May 13 '15 at 14:55
  • 1
    How fine is the location? Is it specific to a 10 mile radius? 100 mile radius? City, country? – sir_k May 13 '15 at 15:01
  • Which browser? What platform? – lorenzog May 13 '15 at 15:04
  • @FlorinCoada very accuracy, show my street. – M. R. May 13 '15 at 15:05
  • 1
    @M.R. you might want to update your question including the details from the comments so it is easier to answer. – lorenzog May 13 '15 at 15:15

Several proxies add extra headers to a session which leaks info such as the X-Forwarded-For header which includes the origin IP address.

Since OP question states there is no GPS/GSM network involved, then one can assume this is running on a desktop, laptop, or WiFi tablet, therefore the location data is likely being acquired by geoip data related to the IP address in the X-Forwarded-For header.

Testing headers

- login to a remote shell outside the proxy
- exec netcat -l -p 8080
- on local browse to remote:8080 with proxy enabled then read the stdout on remote

This also tests for additional data that may be sent. tcpdump can also be run on the remote server.

| improve this answer | |
  • Considering OP post states he's proxing from a desktop environment ( ie no GPS chip, non gsm network) and does not state any WiFi networks involved let alone the proxy would eliminate anyways and given I ran the same app in the same type of environment which produced the same results as OP, one can conclude that the location info is based off the geoip data related to his x-forward-for header passed by the proxy. – Dwight Spencer May 13 '15 at 18:15
  • I completely agree with you, but you are speculating that the x-fwd-for headers are the problem and even phrase your question as 'something to check'. This could, in fact, be the answer, but it is still speculation at this point. If this was a comment to get the OP to check this - THEN you have a definitive answer. That's all I'm saying. – schroeder May 13 '15 at 18:21
  • I like it. I polished some of the wording to remove the confusion at the end. – schroeder May 13 '15 at 18:42
  • I don't think it's x-forwaded-for because i use an extension on Firefox that can fake that with random ips and they still can track my location somehow – Freedo May 13 '15 at 19:30
  • I don't think this is the case. If you look at the code the OP posted it calls navigator.geolocation.getCurrentPosition(). If you want to test your hypothesis of the X-Forwarded-For header you could use Tor and see what happens. You might need to use a Tor SOCKS with a regular browser as Tor's browser bundle might have that disabled. – lorenzog May 14 '15 at 8:38

This answer and this other answer might be relevant for you. In particular, quoting from this wikipedia page

The most common sources of location information are IP address, Wi-Fi and Bluetooth MAC address, radio-frequency identification (RFID), Wi-Fi connection location, or device Global Positioning System (GPS) and GSM/CDMA cell IDs. The location is returned with a given accuracy depending on the best location information source available.

Which means, related to your question, that your browser might acquire that data from sources available on your operating system rather than relying on a web resource.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.