Onionspector – now let's see what The Onion knows about you

2026-09-06 | original

read original get O'Reilly "Web Application Security" by Andrew Hoffman → more articles

Why This Matters

A developer has released Onionspector, a companion to their Onion Service auditing tool Onionservatory, that flips the lens to show what a website can learn about a visitor's browser. It demonstrates how much identifying data leaks through plain HTTP headers alone, and far more once JavaScript is enabled — a reminder that fingerprinting risk comes from combinations of small signals, not any single value.

Key Takeaways

Onionspector shows visitors what data their browser exposes to a site, complementing Onionservatory's service-side security checks.
Even without JavaScript, headers like User-Agent, Accept-Language, Referer, DNT and Client Hints reveal browser configuration.
With JavaScript on, screen size, timezone, fonts, GPU, Canvas and AudioContext combine into a potentially unique fingerprint — the exact thing Tor Browser works to prevent.

Worth a Look

O'Reilly "Web Application Security" by Andrew Hoffman — If poking at HTTP headers, fingerprinting surfaces and security policies sounds like fun, this book walks through exactly how browsers and servers leak information and how to lock it down. It's a great companion for anyone building their own scanning tools like Onionspector or hardening a site's headers.

See O'Reilly "Web Application Security" by Andrew Hoffman on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

A few days ago I built Onionservatory, because apparently Onion Services also deserve to be judged by automated security tools.

It answers questions like:

Is this Onion Service configured properly?

Does it leak resources to the clearnet?

... continue reading

Explore topics: onionspector onion services tor browser fingerprinting http headers