Meek and domain fronting: the Tor bridge that hides inside a CDN
Every bridge type in Tor Browser is an exercise in disguise, but meek takes the most ambitious route: it does not reshape Tor's traffic at all, it simply carries it as the body of ordinary HTTPS requests bound for a large content delivery network. The technique underneath, domain fronting, was once available from every major cloud provider. A decade after its debut, it survives on essentially one, and the meek-azure deployment is the last of that bridge family still in the menu.
How domain fronting hides a Tor connection
The weakness domain fronting exploits is that a TLS handshake hands a censor a convenient label: the Server Name Indication field names the site being visited. The 2015 study by David Fifield and colleagues that brought the technique into censorship circumvention describes how fronting breaks that link. One domain appears on the outside of an HTTPS request, in the DNS query and the TLS handshake, while a different domain appears on the inside, in the HTTP Host header. The censor sees only the front. The Host header is invisible to the censor but visible to the CDN receiving the request, which reads it and forwards the connection to the real destination. Blocking the traffic would mean blocking a busy, ordinary website along with everyone who legitimately uses it. meek turns that idea into a bridge. The client wraps pieces of Tor traffic into HTTP POST requests and pushes them through a fronting CDN to a bridge running meek-server, where a session identifier reassembles the stream; when nothing is pending, the client keeps sending empty polls so the connection does not go quiet. In the original design those requests were even driven through a real browser engine, which is why the study could say of the resulting traffic that it looks like a browser, because it is a browser.2018: the front doors close
The whole scheme rested on cloud providers tolerating a mismatch between the two layers, and in 2018 they stopped. According to Signal's account, Google gave 30 days' notice ending domain fronting support after Signal used App Engine fronting to reach users in Iran, whom Google's own reading of US sanctions law had already cut off. Weeks later, on April 27, 2018, Amazon wrote to Signal warning that it had no permission to use the Souq.com domain as a front, threatened to suspend its CloudFront account, and introduced Enhanced Domain Protections that ended fronting across the CDN. The Tor Project reported the same month that both companies were pulling the plug and that meek had become unusable over their networks; Access Now counted roughly a dozen human rights tools affected, Signal and Telegram among them. Signal's conclusion was blunt: domain fronting as a censorship circumvention technique had become largely non-viable, and its parting observation captured why the shutdowns cost the censors nothing."...didn't have to do anything but wait." - Signal, May 2018
Why meek-azure survived
One provider did not join the retreat. The Tor Project noted at the time that Microsoft's Azure cloud still allowed domain fronting, and the 2015 study had already observed a structural reason: Azure's CDN forwards requests only to Azure-affiliated domains, whereas Amazon's CloudFront would forward almost anywhere. meek's Azure deployment sits entirely inside that estate, with its endpoint hosted on Azure's own CDN behind a Microsoft-controlled front domain, so the request never crosses between unrelated companies. After Google and Amazon stopped letting the visible name and the real destination disagree, that internal tolerance was enough. The Tor Project warned from the start that it had received no advance notice of the other shutdowns, and that Azure's policy could change too, a caveat that has hung over meek-azure ever since.The price of hiding in plain sight
The properties that make meek hard to block also make it slow and expensive. The extra CDN hop and the request-driven design cut measured download speeds by a factor of roughly two to three in the 2015 study, and Tor's current support guidance is plainer still: meek has a bandwidth limitation, so the option will be quite slow. Money is the other constraint. Someone pays CDN egress charges for every byte a meek bridge moves, and the original deployment's bill ran to $565 on Azure, $3,292 on Google App Engine and $3,793 on CloudFront over the course of the study. The researchers also warned that an adversary could inflate that bill at will, the financial denial-of-service problem demonstrated when the Great Cannon drove tens of thousands of dollars in bandwidth charges onto its targets' cloud hosting.When meek is the right choice
For most censored users meek is a fallback, not a first pick. Tor's current guidance for China suggests WebTunnel first and lists meek and Snowflake as backups if it fails. The mainstream options each make a different trade:- obfs4 scrambles traffic and is fast and free, but each bridge is an individual server whose address can leak or be scanned.
- Snowflake borrows ephemeral volunteer proxies, easy to scale but variable in speed.
- WebTunnel makes Tor look like a regular HTTPS connection to a web server without needing a CDN giant's cooperation.
- meek hides behind one of the web's busiest domains, surviving the tightest allow-lists at low speed.