Favicon media proxy returns 404 for some domains due to HTTP/HTTPS mismatch

[bndrmrtn]

Before submitting

• I searched the existing issues and did not find a duplicate.
• I removed passwords, tokens, payment information, private messages, and other sensitive or personal information.
• This report does not contain a sensitive security vulnerability. If I am unsure, I will report it privately instead.

Affected area

Widgets

Problem description

Hey! I noticed a possible issue with the favicon media proxy.

For example, this URL returns a 404 Not Found instead of the favicon:

https://media-proxy.yoursit.ee/https://www.google.com/s2/favicons?sz=64&domain=blog.mrtn.vip

While investigating, I found that Google's favicon service appears to resolve the domain using this URL:

https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://blog.mrtn.vip&size=64

Notice that the url parameter uses http://blog.mrtn.vip rather than https://blog.mrtn.vip. This may be related to why the current proxy request fails.

Would it make sense for the media proxy to use Google's faviconV2 endpoint instead, while preserving the correct protocol and domain? For example:

https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url={CORRECT_PROTOCOL_AND_DOMAIN}&size=64

This might make favicon fetching more reliable for domains where the protocol matters.

Thanks, and apologies if I've missed any issue-reporting guidelines!

Steps to reproduce

• Open the following favicon through the media proxy:

• https://media-proxy.yoursit.ee/https://www.google.com/s2/favicons?sz=64&domain=blog.mrtn.vip

• Observe the response.

• Open Google's favicon endpoint directly:

• https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://blog.mrtn.vip&size=64

• Observe that the favicon is returned successfully.

Expected result

The media proxy should successfully return the favicon for blog.mrtn.vip.

Ideally, it could proxy Google's newer faviconV2 endpoint while using the correct protocol and domain, for example:

https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url={CORRECT_PROTOCOL_AND_DOMAIN}&size=64

Actual result

The proxied google.com/s2/favicons request returns 404 Not Found, so no favicon is displayed.

The faviconV2 endpoint, however, successfully returns the favicon. It also appears to use http://blog.mrtn.vip as the URL, which suggests that the protocol may affect how the favicon is resolved.

Frequency

Every time

YourSitee plan

Free

Affected URL or public Sitee

No response

Browser and version

Firefox 151.0.2

Operating system

Fedora Linux 43 (KDE Plasma Desktop 4

Device

Asus Laptop

Where does it happen?

Not applicable

Screenshots or video

No response

Error messages or console output

Relevant conditions

No response

Impact

The issue prevents favicons from being displayed for some websites when they are fetched through the media proxy, resulting in a broken or missing favicon.

A workaround exists by fetching the favicon directly through Google’s faviconV2 endpoint with the correct protocol and domain, but this cannot be used transparently through the current media proxy implementation.

Additional context

No response