Whonix.org onion - Impossible to view images on Discourse on standard mode in Tor Browser

Website
1

They do not load. Inspect element hacks are required to extract a direct link to the image. Can this be fixed?

1 Like
2

Seems to work on my end.

Screenshot_2026-02-18_22-05-41
Screenshot_2026-02-18_22-05-411418×1071 372 KB

2 Likes
3

For example the following oneboxing thumbnail won’t load.

Reason: Content Security Policy (CSP)

Note: Whonix is based on Kicksecure

Expected for Kicksecure and Whonix forums due to CSP. Cross-domain content is refused. This is a webserver specific setting.

2 Likes
4

Screenshot 2026-02-19 at 12-45-19 Impossible to view images on Discourse on standard mode in Tor Browser - Website - Whonix Forum
Screenshot 2026-02-19 at 12-45-19 Impossible to view images on Discourse on standard mode in Tor Browser - Website - Whonix Forum1388×794 49.7 KB

This is what it looks like for me. This has been an issue for a while, but was not an issue before 2025 (I don’t remember when it started happening exactly). I am using an unmodified disposable.

It looks like the files are loaded from the clearnet domain, which is blocked by CSP policy when using the onion site.

Content-Security-Policy: The page’s settings blocked the loading of a resource (img-src) at https://forums.whonix.org/uploads/default/original/2X/9/9dfe8cbe83d2ae590231c5d939bfcf41aa327b93.png because it violates the following directive: “img-src ‘self’ data: http://*.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion”

Add also *.whonix.org? :slightly_smiling_face:

1 Like
5

Confirmed. Broken on the onion.

Probably not a Tor Browser issue. Instead, a server configuration issue. The rewrite to onion link is broken, maybe due to frontend(cache) vs backend(application) gzip/br compression settings.

I might be able to fix this at some point.

Not added by design as onion users typically want to use the onion exclusively and don’t want any links to clearnet. (Onion forum site redirects to clearnet)

Related:

2 Likes