Per Tab Proxy is Obscure and Broken

[issuant]

A comment on reddit just informed me that it is possible to set a proxy per tab. This was surprising information as it's not mentioned in any official documents at all and almost impossible to 'stumble on' with how the extension popup is designed.

I played around with it and the UX is not good at all. With how it is currently, it isn't so much a 'per tab' proxy as it is a 'per site' proxy. There are no options to actually pre-set a preferred location in the new tab until after fully loading a website, identifying you to the website across both locations.

After setting it, I now cannot find a way to deactivate the 'per site' proxy. Only a notification that the website is proxied through a different location than the general browser and new buttons with no explanation that never go away, 'Never Proxy' and 'Turn Off DNS'. The per site proxy persists even with browser relaunches and the 'New Identity' button does nothing to help.

There is also no way to find out which sites may have a preexisting proxy configured so you simply have to wing it and be surprised when some website loads.

[ruihildt]

Thank you for your feedback @issuant.

This is not advertised as a Mullvad Browser feature, because it's a Mullvad Browser Extension feature (I have moved this issue to the extension project).
You can use it outside of Mullvad Browser (basically on any modern Firefox-based browser), as long as you are a Mullvad VPN user.

The feature is not fully developed yet, and there are some hard edges as you have discovered. I'm currently working on having a list of configured proxies.

It is an interesting thought to open a new tab using a specific proxy, and I'm interested in how you imagine that would work in terms of user experience:

• would you set a "new tab" default proxy?
• how would that be different from "Proxy for all websites"?
• there's a plan to randomize from available proxy location when visiting a website, would that solve your use case?

[issuant]

It is an interesting thought to open a new tab using a specific proxy, and I'm interested in how you imagine that would work in terms of user experience:

* would you set a "new tab" default proxy?

Not sure if I understand the question correctly. What I want is to have an option to set the proxy per tab, before loading any website, not so much a default for new tabs in general.

With this implemented, it would possible to open a new tab (A) then set its proxy to Location1 before navigating to any website, and then another new tab (B) to Location2 also before navigating to any website in there. Further, unlike the current design where it is 'per site', all traffic regardless of the sites navigated to will go through Location1 and Location2 in new tabs A and B respectively.

* how would that be different from "Proxy for all websites"?

'Proxy for all websites' applies to all tabs. What I am asking for is an option to have an exception to that when opening a new tab.

* there's a plan to randomize from available proxy location when visiting a website, would that solve your use case?

That sounds useful but is a different feature.

[issuant]

@ruihildt

Separately, there should be an option to turn this off (and maybe it shouldn't persist with browser relaunches unless the user explicitly sets it, like with a lock button). I currently have a few sites with a 'per site' proxy that I simply have not found a way to turn off. That's no good.

[ruihildt]

Here's my first try at addressing those issues. I would be grateful if any of you could give me some feedback.

Screencast_20240814_174934.webm

[ruihildt]

It's now possible to add a proxy manually:

[issuant]

That looks fantastic! Love the 'full screen view' too.

On a related note, I cannot tell if it's changed already since it's not shown in the webm or screenshot but a searchbox when using 'Select location', like in the desktop and mobile apps, is needed.

[issuant]

Your reply in #232 has left me curious. This implementation is not 'per tab' so, and I am not sure if this is the right framing but, does the custom proxy apply to everything loaded 'through' the specific domain?

For example, Github has assets that come in from https://*.githubusercontent.com, which is a different domain than https://github.com. If my 'Default proxy' is Belgium and my 'Custom proxy' for https://github.com is Albania, what does https://*.githubusercontent.com in the tab see?

[ruihildt]

Fixed by #243

[issuant]

@ruihildt Anything on this?

This implementation is not 'per tab' so, and I am not sure if this is the right framing but, does the custom proxy apply to everything loaded 'through' the specific domain? If my 'Default proxy' is Belgium and my 'Custom proxy' for https://github.com/ is Albania, what does https://*.githubusercontent.com in the tab see?

[ruihildt]

Sorry missed it, here is the behavior:

• set a proxy for domain.tld
• load a website domain.tld
• in the current tab where the domain is being loaded, all requests emitted from that tab will be proxied through the same proxy

So yes, every request initiated from a domain (including third party domains) will use the same proxy.

If you want to look at the code, here are the two relevant functions taking care of this logic:

• browser-extension/src/helpers/socksProxy.ts

  Line 86 in ab56f6f

  const getCurrentHost = (details: RequestDetails) => {

• browser-extension/src/helpers/socksProxy.ts

  Line 52 in ab56f6f

  export const handleProxyRequest = async (details: browser.proxy._OnRequestDetails) => {

[issuant]

So yes, everything loaded through the specific domain will use the same proxy

Sorry @ruihildt, there is still some confusion. What happens to underlying requests to a different domain? Like in the Github example, the domain is github.com, but things like images and webms come through the entirely different https://*.githubusercontent.com domain.

Simply, if my default proxy is Belgium but github.com is set to Albania, do https://*.githubusercontent.com requests see Belgium or Albania?

[ruihildt]

I have edited my explanation for clarity:

So yes, every request initiated from a domain (including third party domains) will use the same proxy.

So if github.com is set to proxy through Albania, then assets loaded from third party domains like https://*.githubusercontent.com will load through the same Albania proxy.

If you load in a new tab https://*.githubusercontent.com, it will follow the all websites proxy configuration.

[ruihildt]

While working on the sub-domain matching feature, I have noticed there's some speculative connection going outside of the proxy.

This is because their origin are inaccurate:

In the next version of the extension, these speculative requests are simply blocked.

[issuant]

So if github.com is set to proxy through Albania, then assets loaded from third party domains like https://*.githubusercontent.com will load through the same Albania proxy.

If you load in a new tab https://*.githubusercontent.com, it will follow the all websites proxy configuration.

@ruihildt That is interesting. So is this below correct if all websites is set to Belgium?

In the first tab, youtube.com is open. youtube.com sees Belgium.
In the second tab, disqus.com which has a proxy set to France is open and loads fonts from fonts.google.com. disqus.com and fonts.google.com both see France.
In the third tab, someblog.com which has a proxy set to Albania is open and loads embedded disqus.com and youtube.com content. someblog.com, and both youtube.com and disqus.com here all see Albania separately from the other two tabs.

[ruihildt]

Yes that is correct.

[issuant]

Fantastic.