使用TOR访问Flutter+Firebase聊天Web应用时出现Cross-Origin Request Blocked错误

• 基于Flutter+Firebase开发的聊天Web应用，在Chrome、Safari、Firefox等普通浏览器中运行正常
• 通过TOR浏览器访问时：
  • 页面加载正常
  • 尝试登录/注册时控制台出现CORS错误
  • 使用原始明文主机名在TOR中可正常登录/注册，但通过TOR隐藏服务的洋葱链接访问时触发错误

错误日志 #

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=AIzaSyDp0fmvGxlSPXR8_4DVW6oKNBTKUFODDSs. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 403.

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=AIzaSyDp0fmvGxlSPXR8_4DVW6oKNBTKUFODDSs. (Reason: CORS request did not succeed). Status code: (null)

已尝试操作 #

• 在Firebase控制台的授权域名中添加了洋葱域名
• 在Nginx中配置了CORS头部（配置代码如下）：

server {
    listen 8444;
    server_name mysite.onion;

    location / {
        root /var/www/mysite;
        index index.html;

       # Add CORS headers
        add_header 'Access-Control-Allow-Origin' 'https://mysite.onion' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Con>

       # Optional: Add more CORS headers if needed
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';

 }

1. 修正Nginx的CORS配置错误 #

你的Nginx配置中Access-Control-Allow-Headers字段内容被截断，且未处理CORS预检的OPTIONS请求，完整配置如下：

server {
    listen 8444;
    server_name mysite.onion;

    location / {
        root /var/www/mysite;
        index index.html;

        # 处理OPTIONS预检请求
        if ($request_method = OPTIONS) {
            add_header 'Access-Control-Allow-Origin' 'https://mysite.onion' always;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
            add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization' always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;
            add_header 'Content-Length' 0;
            add_header 'Content-Type' 'text/plain charset=UTF-8';
            return 204;
        }

        # 常规请求的CORS头部
        add_header 'Access-Control-Allow-Origin' 'https://mysite.onion' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization' always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
    }
}

修改后重启Nginx：sudo systemctl restart nginx

2. 确认Firebase授权域名配置 #

• 登录Firebase控制台，进入Authentication > Settings > Authorized domains
• 确保已添加完整的洋葱域名（包含https://前缀，例如https://mysite.onion）
• 保存配置后等待5-10分钟让配置生效

3. 解决Google Identity Toolkit的TOR跨域限制 #

错误提示的是identitytoolkit.googleapis.com的CORS问题，这是因为TOR浏览器的代理环境下，Google的API可能对洋葱域名的跨域请求有特殊限制。可以通过以下方式解决：

• 使用Firebase Functions作为代理：创建一个云函数，将登录/注册请求转发到identitytoolkit.googleapis.com，然后前端调用自己的洋葱域名下的云函数端点，避免直接跨域请求Google的API
• 示例Firebase Functions代码（Node.js）：

const functions = require("firebase-functions");
const axios = require("axios");

exports.proxySignIn = functions.https.onRequest(async (req, res) => {
  try {
    const response = await axios.post(
      "https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=YOUR_FIREBASE_API_KEY",
      req.body,
      { headers: { "Content-Type": "application/json" } }
    );
    res.set("Access-Control-Allow-Origin", "https://mysite.onion");
    res.set("Access-Control-Allow-Credentials", "true");
    res.status(response.status).json(response.data);
  } catch (error) {
    res.status(error.response.status).json(error.response.data);
  }
});

部署后，前端将登录请求指向https://mysite.onion/proxySignIn而非直接调用Google的API

4. 检查TOR隐藏服务配置 #

• 确保TOR配置文件（/etc/tor/torrc）中隐藏服务的端口转发正确指向Nginx监听的8444端口：

HiddenServiceDir /var/lib/tor/mysite_onion/
HiddenServicePort 443 127.0.0.1:8444

• 重启TOR服务：sudo systemctl restart tor

内容的提问来源于stack exchange，提问作者Zeyneb Kerim