test-website-a.pages.dev — 21 tests — GitHub
See also: Test Website B
A bare page holding a single required input with type="email", a placeholder, and autocomplete="email", for exercising browser autofill on the simplest possible form.
email-input-autofill/Tests service-worker requests wrongly blocked by Brave. Section 1: with Shields down, a tracker is requested from the page and a service worker via fetch() (brave-browser#34107) and importScripts() (brave-browser#35461); a buggy build blocks the worker request (lost tab_origin) while the page request is allowed. Section 2: a service-worker fetch handler intercepts a cross-origin request to test-website-b and re-issues it; fetch(event.request) is blocked while fetch(request.url) works, regardless of Shields (brave-browser#25855).
service-worker-shields-down/Tests whether 'Forget me when I close this site' clears the Cache Storage API (window.caches) written by a cross-site iframe after the site is closed.
iframe-cache-clearing/Tests whether a WebSocket opened inside a frameless worker (SharedWorker or ServiceWorker) bypasses Brave Shields network filtering. Brave only intercepts WebSockets when Chromium supplies a non-null RenderFrameHost, so a frameless worker socket skips BraveProxyingWebSocket and the adblock engines. The same endpoint is opened from the page, a dedicated worker, a shared worker, and a service worker; with a matching custom filter, the page and dedicated worker are blocked while the shared and service workers connect.
shared-worker-shields-bypass/Tests for Brave's De-AMP feature: canonical-URL extraction and redirect behavior, including Sec-Fetch-Site preservation, CSP sandbox enforcement, Content-Disposition handling, and address-bar (omnibox) spoofing.
de-amp/Loads a web font from Google's servers (fonts.googleapis.com / fonts.gstatic.com) and checks whether the download actually succeeded.
google-font-loading/Tests whether 'Forget me when I close this site' clears the Cache Storage API (window.caches) after the site is closed.
cache-storage-clearing/Tests for security and privacy behavior inside about:blank and other local iframes — content filtering, cookies, JS fetch, mixed content, network scan, permissions, and secure content.
local-frames/Draws an identical canvas on both sites and measures how much Brave's per-eTLD+1 farbling actually changes the readback.
canvas-farbling/Tests whether the Payment Request API leaks the full Accept-Language header even when 'Prevent sites from fingerprinting me based on my language preferences' is enabled. Brave reduces Accept-Language in BraveProxyingURLLoaderFactory, but PaymentManifestDownloader fetches manifests through the browser-process URLLoaderFactory (kPaymentRequestUseRendererUrlLoader is disabled by default), which is not proxied, so the full language list leaks.
payment-request-language-bypass/Tests whether timing differences in IndexedDB durability modes, OPFS SyncAccessHandle flush, and CacheStorage operations can reveal private browsing mode. Covers three detection methods reported in brave-browser#56009.
incognito-detection-timing/Tests whether Brave's fingerprinting farbling protections apply to blob: URLs opened in a new tab. Blob pages bypass the SchemeIsHTTPOrHTTPS check in GetBraveShieldsEnabled(), leaking real screen size, hardwareConcurrency, deviceMemory, languages, and user agent.
blob-farbling-bypass/Tests whether storage written by a cross-site iframe is cleared after the embedding first-party site is closed or navigated away from.
ephemeral-3p-clearing/Tests whether the browser correctly distinguishes svh, lvh, and dvh viewport units on mobile, per CSS Values Level 4.
viewport-units/Tests whether the browser incorrectly resizes the layout viewport when the virtual keyboard appears.
viewport-keyboard/Tests whether browsers protect against <noscript>-based permanent redirects to a subdomain when JavaScript is disabled.
noscript-redirect/Tests whether storage quota APIs leak different values in normal vs. private browsing, enabling incognito detection. Covers both the modern navigator.storage API and the legacy webkitTemporaryStorage API.
storage-quota-fingerprint/Tests browser behavior on a server-side 302 redirect to a cross-site destination (lobste.rs).
server-redirect/Tests whether a cross-site iframe can read cookies set when its origin was top-level.
third-party-cookies/Tests whether a cross-site iframe can regain access to its first-party cookies via the Storage Access API.
storage-access/Tests whether the browser clears window.name on cross-origin navigations.
window-name-clearing/