test-website-a.pages.dev — 26 tests — GitHub
See also: Test Website B
Compares screen and window size values read by this page, a same-site iframe, and a cross-site iframe. With fingerprinting protection on, all three should match.
screen-farbling-iframes/Checks whether the OpenAI ads measurement pixel loads, sends events, or sets cookies.
openai-ads-pixel/Requests a set of third-party URLs from this page and reports which ones were blocked.
request-blocking/Tests whether flipping a Shields toggle on a page served with Content-Security-Policy: sandbox allow-scripts edits the global Shields defaults instead of creating a per-site exception. The sandboxed document has an opaque origin, so there is no site to scope an exception to.
csp-sandbox-shields-scope/A bare page holding a single required input with type="email", a placeholder, and autocomplete="email", for exercising browser autofill on the simplest possible form.
email-input-autofill/Tests service-worker requests wrongly blocked by Brave. Section 1: with Shields down, a tracker is requested from the page and a service worker via fetch() (brave-browser#34107) and importScripts() (brave-browser#35461); a buggy build blocks the worker request (lost tab_origin) while the page request is allowed. Section 2: a service-worker fetch handler intercepts a cross-origin request to test-website-b and re-issues it; fetch(event.request) is blocked while fetch(request.url) works, regardless of Shields (brave-browser#25855).
service-worker-shields-down/Tests whether 'Forget me when I close this site' clears the Cache Storage API (window.caches) written by a cross-site iframe after the site is closed.
iframe-cache-clearing/Tests whether a WebSocket opened inside a frameless worker (SharedWorker or ServiceWorker) bypasses Brave Shields network filtering. Brave only intercepts WebSockets when Chromium supplies a non-null RenderFrameHost, so a frameless worker socket skips BraveProxyingWebSocket and the adblock engines. The same endpoint is opened from the page, a dedicated worker, a shared worker, and a service worker; with a matching custom filter, the page and dedicated worker are blocked while the shared and service workers connect.
shared-worker-shields-bypass/Tests for Brave's De-AMP feature: canonical-URL extraction and redirect behavior, including Sec-Fetch-Site preservation, CSP sandbox enforcement, Content-Disposition handling, and address-bar (omnibox) spoofing.
de-amp/Loads a web font from Google's servers (fonts.googleapis.com / fonts.gstatic.com) and checks whether the download actually succeeded.
google-font-loading/Tests whether 'Forget me when I close this site' clears the Cache Storage API (window.caches) after the site is closed.
cache-storage-clearing/Tests for security and privacy behavior inside about:blank and other local iframes — content filtering, cookies, JS fetch, mixed content, network scan, permissions, and secure content.
local-frames/Draws an identical canvas on both sites and measures how much Brave's per-eTLD+1 farbling actually changes the readback.
canvas-farbling/Tests whether the Payment Request API leaks the full Accept-Language header even when 'Prevent sites from fingerprinting me based on my language preferences' is enabled. Brave reduces Accept-Language in BraveProxyingURLLoaderFactory, but PaymentManifestDownloader fetches manifests through the browser-process URLLoaderFactory (kPaymentRequestUseRendererUrlLoader is disabled by default), which is not proxied, so the full language list leaks.
payment-request-language-bypass/Tests whether timing differences in IndexedDB durability modes, OPFS SyncAccessHandle flush, and CacheStorage operations can reveal private browsing mode. Covers three detection methods reported in brave-browser#56009.
incognito-detection-timing/Tests whether Brave's fingerprinting farbling applies inside popups. With Shields up and fingerprinting protection on, nine surfaces are read in the opener, in a blank popup from window.open(''), and in a popup from a blob: URL. Both popups report the device's real values while the opener reports randomized ones. One popup per click, since a click allows exactly one.
popup-farbling/Tests whether Brave's fingerprinting farbling applies to a page opened from a blob: URL. With Shields up and fingerprinting protection on, nine surfaces are read in this page and in the blob: page, which is same-origin with its creator and so hands its readings back through localStorage before closing itself. The blob: page reports the device's real values while this page reports randomized ones.
blob-farbling-bypass/Tests whether storage written by a cross-site iframe is cleared after the embedding first-party site is closed or navigated away from.
ephemeral-3p-clearing/Tests whether the browser correctly distinguishes svh, lvh, and dvh viewport units on mobile, per CSS Values Level 4.
viewport-units/Tests whether the browser incorrectly resizes the layout viewport when the virtual keyboard appears.
viewport-keyboard/Tests whether browsers protect against <noscript>-based permanent redirects to a subdomain when JavaScript is disabled.
noscript-redirect/Tests whether storage quota APIs leak different values in normal vs. private browsing, enabling incognito detection. Covers both the modern navigator.storage API and the legacy webkitTemporaryStorage API.
storage-quota-fingerprint/Tests browser behavior on a server-side 302 redirect to a cross-site destination (lobste.rs).
server-redirect/Tests whether a cross-site iframe can read cookies set when its origin was top-level.
third-party-cookies/Tests whether a cross-site iframe can regain access to its first-party cookies via the Storage Access API.
storage-access/Tests whether the browser clears window.name on cross-origin navigations.
window-name-clearing/