iOS Browsers(default settings) |
brave 1.96 |
chrome 155.8059 |
duckduckgo 7.241 |
edge 155.4283 |
firefox 158.0 |
focus 155.0 |
safari 26.6 |
vivaldi 8.4147 |
|---|---|---|---|---|---|---|---|---|
|
State Partitioning testsWhich browsers isolate websites to prevent them from sharing data to track you?
A common vulnerability of web browsers is that they allow tracking companies to 'tag' your browser with some data ('state') that identifies you. When third-party trackers are embedded in websites, they can see this identifying data as you browse to different websites. Fortunately, it is possible for this category of leaks to be fixed by partitioning all data stored in the browser such that no data can be shared between websites.
|
||||||||
|
Alt-Svc
Alt-Svc allows the server to indicate to the web browser that a resource should be loaded on a different server. Because this is a persistent setting, it could be used to track users across websites if it is not correctly partitioned. |
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party: h3, h3, Error: Unsupported, h3, Error: Unsupported
result, different first party: h2, h2, h2, h2, h2
unsupported: false, false, true, false, true
passed: true, true, true
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party: h3, h3, Error: Unsupported, h3, Error: Unsupported
result, different first party: h2, h2, h2, h2, h2
unsupported: false, false, true, false, true
passed: true, true, true
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party: h3, Error: Unsupported, h3, Error: Unsupported, h3
result, different first party: h2, h2, h2, h2, h2
unsupported: false, true, false, true, false
passed: true, true, true
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party:
Error: Unsupported,
h3,
Error: Unsupported,
h3,
Error: Unsupported
result, different first party: h2, h2, h2, h2, h2
unsupported: true, false, true, false, true
passed: , true, true
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party: h3, Error: Unsupported, h3, Error: Unsupported, h3
result, different first party: h2, h2, h2, h2, h2
unsupported: false, true, false, true, false
passed: true, true, true
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party: h3, Error: Unsupported, h3, Error: Unsupported, h3
result, different first party: h2, h2, h2, h2, h2
unsupported: false, true, false, true, false
passed: true, true, true
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same first party: h3, Error: Unsupported, h3, Error: Unsupported, h3
result, different first party: h2, h2, h2, h2, h2
unsupported: false, true, false, true, false
passed: true, true, true
test failed: false, false, false, false, false
|
|
blob
A 'blob URL' is a local reference to some raw data. Trackers can use a blob URL to share data between websites. |
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const blobURL = URL.createObjectURL(new Blob([secret]));
fetch(`${baseURI}blob?mode=write&key=${secret}&blobUrl=${encodeURIComponent(blobURL)}`);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async (secret) => {
const response = await fetch(`${baseURI}blob?mode=read&key=${secret}`);
const result = await response.json();
const blobUrl = decodeURIComponent(result.blobUrl);
const blobResponse = await fetch(blobUrl);
return blobResponse.text();
}
result, same first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
result, different first party:
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed,
Error: Load failed
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
|
BroadcastChannel
A BroadcastChannel is designed to send messages between tabs. In some browsers it can be used for cross-site communication and tracking. |
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: (secret) => {
try {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data === 'request') {
bc.postMessage(secret);
}
};
} catch (e) {
throw new Error('Unsupported');
}
}
read: () =>
new Promise((resolve, reject) => {
const bc = new BroadcastChannel('secrets');
bc.onmessage = (event) => {
if (event.data !== 'request') {
resolve(event.data);
}
};
bc.postMessage('request');
setTimeout(() => reject(new Error('no BroadcastChannel message')), 3000);
})
result, same first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
result, different first party:
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message,
Error: no BroadcastChannel message
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
|
CacheStorage
The Cache API is a content storage mechanism originally introduced to support ServiceWorkers. If the same Cache object is accessible to multiple websites, it can be abused to track users. |
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
61dcc06f-fcc3-4352-9325-e7a4cb1166b8,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
ebf2de62-557c-4374-bd92-c6951d45a072,
ebf2de62-557c-4374-bd92-c6951d45a072,
ebf2de62-557c-4374-bd92-c6951d45a072,
ebf2de62-557c-4374-bd92-c6951d45a072,
ebf2de62-557c-4374-bd92-c6951d45a072
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
33cff721-4f19-4384-90f7-28875626f425,
33cff721-4f19-4384-90f7-28875626f425,
33cff721-4f19-4384-90f7-28875626f425,
33cff721-4f19-4384-90f7-28875626f425,
33cff721-4f19-4384-90f7-28875626f425
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
04952854-3358-4881-9e6e-a019dbb2b47b,
04952854-3358-4881-9e6e-a019dbb2b47b,
04952854-3358-4881-9e6e-a019dbb2b47b,
04952854-3358-4881-9e6e-a019dbb2b47b,
04952854-3358-4881-9e6e-a019dbb2b47b
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same first party:
dd027d1b-495e-4a45-ad74-c0fdaba86413,
dd027d1b-495e-4a45-ad74-c0fdaba86413,
dd027d1b-495e-4a45-ad74-c0fdaba86413,
dd027d1b-495e-4a45-ad74-c0fdaba86413,
dd027d1b-495e-4a45-ad74-c0fdaba86413
result, different first party:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
cookie (HTTP)
The cookie, first introduced by Netscape in 1994, is a small amount of data stored by your browser on a website's behalf. It has legitimate uses, but it is also the classic cross-site tracking mechanism, and today still the most popular method of tracking users across websites. Browsers can stop cookies from being used for cross-site tracking by either blocking or partitioning them. |
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_http,
64f65157-4029-4cca-a826-90689e865af8_http,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_http,
99fd256d-4878-40ed-93ae-ee6150a82b84_http,
ef6f996a-ad7d-48ba-be85-1035b0879537_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99_http,
b7de0a15-d667-44bd-b485-8711032ae50b_http,
b1078821-b8a3-4434-8f5a-64d3136aebfe_http,
19d71a06-b303-455f-971c-77cbf3e15b10_http,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_http,
64fe2704-8adf-49ac-8923-03df5ab64bca_http,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_http,
0813080a-3a11-4d62-8333-01dfe7fbed0f_http,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862_http,
b623e490-c042-4a45-ab13-bccadc84c941_http,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_http,
2a430bed-9590-4cdf-b54c-7c75036daf4c_http,
64e9c8ba-9d43-4487-b797-06c0682bb337_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_http,
14b79b00-6d79-4199-a149-b9e11b980e76_http,
c109ccae-27bb-445a-ba2e-b4b347005dab_http,
b2d4efdd-ed26-40e0-a703-774607626ac2_http,
8e293932-ee92-4938-8bf4-98ed034e24a2_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_http,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_http,
95ca9047-9f51-4aa9-b92c-24d990ff274e_http,
82511263-dcde-4054-875a-4f45afb136be_http,
a743b6b9-da56-43c3-9dd7-29de73c67576_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_http,
5e587c18-f655-4204-a29b-c126a9ba83a5_http,
7d5061a3-5c01-46ab-86a7-705119ed3294_http,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_http,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e_http,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_http,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_http,
2bd1c479-7336-43c9-b86e-406486807d13_http,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_http
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
cookie (JS)
The cookie, first introduced by Netscape in 1994, is a small amount of data stored by your browser on a website's behalf. It has legitimate uses, but it is also the classic cross-site tracking mechanism, and today still the most popular method of tracking users across websites. Browsers can stop cookies from being used for cross-site tracking by either blocking or partitioning them. |
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_js,
64f65157-4029-4cca-a826-90689e865af8_js,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_js,
99fd256d-4878-40ed-93ae-ee6150a82b84_js,
ef6f996a-ad7d-48ba-be85-1035b0879537_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99_js,
b7de0a15-d667-44bd-b485-8711032ae50b_js,
b1078821-b8a3-4434-8f5a-64d3136aebfe_js,
19d71a06-b303-455f-971c-77cbf3e15b10_js,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_js,
64fe2704-8adf-49ac-8923-03df5ab64bca_js,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_js,
0813080a-3a11-4d62-8333-01dfe7fbed0f_js,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862_js,
b623e490-c042-4a45-ab13-bccadc84c941_js,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_js,
2a430bed-9590-4cdf-b54c-7c75036daf4c_js,
64e9c8ba-9d43-4487-b797-06c0682bb337_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_js,
14b79b00-6d79-4199-a149-b9e11b980e76_js,
c109ccae-27bb-445a-ba2e-b4b347005dab_js,
b2d4efdd-ed26-40e0-a703-774607626ac2_js,
8e293932-ee92-4938-8bf4-98ed034e24a2_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_js,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_js,
95ca9047-9f51-4aa9-b92c-24d990ff274e_js,
82511263-dcde-4054-875a-4f45afb136be_js,
a743b6b9-da56-43c3-9dd7-29de73c67576_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_js,
5e587c18-f655-4204-a29b-c126a9ba83a5_js,
7d5061a3-5c01-46ab-86a7-705119ed3294_js,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_js,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e_js,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_js,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_js,
2bd1c479-7336-43c9-b86e-406486807d13_js,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_js
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
CookieStore
The Cookie Store API is an alternative asynchronous API for managing cookies, supported by some browsers. |
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99,
b7de0a15-d667-44bd-b485-8711032ae50b,
b1078821-b8a3-4434-8f5a-64d3136aebfe,
19d71a06-b303-455f-971c-77cbf3e15b10,
7050dfb8-26a5-4b10-8a5f-d6638272b77e
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53,
64fe2704-8adf-49ac-8923-03df5ab64bca,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
0813080a-3a11-4d62-8333-01dfe7fbed0f,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862,
b623e490-c042-4a45-ab13-bccadc84c941,
c69d25b6-99e1-4de1-9560-73e614c6ec4d,
2a430bed-9590-4cdf-b54c-7c75036daf4c,
64e9c8ba-9d43-4487-b797-06c0682bb337
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908,
14b79b00-6d79-4199-a149-b9e11b980e76,
c109ccae-27bb-445a-ba2e-b4b347005dab,
b2d4efdd-ed26-40e0-a703-774607626ac2,
8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656,
a73731aa-d0e5-40fe-969b-c50b5095c0cd,
95ca9047-9f51-4aa9-b92c-24d990ff274e,
82511263-dcde-4054-875a-4f45afb136be,
a743b6b9-da56-43c3-9dd7-29de73c67576
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
5e587c18-f655-4204-a29b-c126a9ba83a5,
7d5061a3-5c01-46ab-86a7-705119ed3294,
c44c02c8-b0ac-4a7e-9292-ad1d15669220,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e,
936251c8-f2a6-49a7-9968-b62c87c4dbe6,
7ecb0b5e-06ac-4f0b-9877-13941aafa595,
2bd1c479-7336-43c9-b86e-406486807d13,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
CSS cache
CSS stylesheets are cached, and if that cache is shared between websites, it can be used to track users across sites. |
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_6862209064014413,
fake_385262424520846,
fake_07731021964505302,
fake_5154335332604276,
fake_8627604071530413
result, different first party:
fake_28126550410659146,
fake_3879161466440255,
fake_4083852266016972,
fake_9372699695434004,
fake_5728610118206452
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_4011739014579585,
fake_24252648479980965,
fake_8175633785509651,
fake_9483076116249658,
fake_6840353913664801
result, different first party:
fake_4630701243531059,
fake_9464150911917777,
fake_3797948542534706,
fake_03442843669658546,
fake_7448139177175193
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_5224876330584483,
fake_1814229250176531,
fake_8711925592367002,
fake_9097506616564905,
fake_7056189572375269
result, different first party:
fake_5443046011664747,
fake_9773335442460787,
fake_7578868152149996,
fake_6505574437330968,
fake_18366615123772467
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_451913614108602,
fake_5903901775845746,
fake_5919312309896752,
fake_5202915694614925,
fake_2199989907593225
result, different first party:
fake_2120411832855209,
fake_4517398843221838,
fake_9637544830132756,
fake_37266097327931114,
fake_3870415762707726
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_6350674357264317,
fake_8074205669169323,
fake_17319362601958055,
fake_43180772915210097,
fake_5898726195555921
result, different first party:
fake_26236640200942296,
fake_973124436474996,
fake_7248470549331918,
fake_9267110591229337,
fake_4271225441034612
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_830739004705527,
fake_0796926227644994,
fake_4140696278674063,
fake_5665362830705301,
fake_3933534586551899
result, different first party:
fake_9459089588930851,
fake_4535014883527062,
fake_5184237567689984,
fake_6629399080631786,
fake_8713458846257813
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_4904472931188535,
fake_12042991489221921,
fake_6582675459022969,
fake_19182439991464517,
fake_4776442346559604
result, different first party:
fake_7414443080691124,
fake_4344619284525548,
fake_531262005665871,
fake_5888498032734795,
fake_6599962336751282
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same first party:
fake_7236215702894253,
fake_7524095864440419,
fake_7998042428770658,
fake_0814428226000754,
fake_33266402119584093
result, different first party:
fake_3386966761855308,
fake_41087777698301475,
fake_9897647819337314,
fake_21561990642835727,
fake_44526521538474473
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
favicon cache
A favicon is an icon that represents a website, typically shown in browser tab and bookmarks menu. If the favicon cache is not partitioned, it can be used to track users across websites. |
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
fetch cache
When a resource is received via the Fetch API, it is frequently cached. That cache can potentially be abused for cross-site tracking. |
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 2, 2, 2, 2, 2
result, different first party: 3, 3, 3, 3, 3
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
font cache
Web fonts are sometimes stored in their own cache, which is vulnerable to being abused for cross-site tracking. |
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
getDirectory
navigator.storage.getDirectory exposes a location for storing files to web content. In some cases, these files may be shared across tabs. |
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99,
b7de0a15-d667-44bd-b485-8711032ae50b,
b1078821-b8a3-4434-8f5a-64d3136aebfe,
19d71a06-b303-455f-971c-77cbf3e15b10,
7050dfb8-26a5-4b10-8a5f-d6638272b77e
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53,
64fe2704-8adf-49ac-8923-03df5ab64bca,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
0813080a-3a11-4d62-8333-01dfe7fbed0f,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862,
b623e490-c042-4a45-ab13-bccadc84c941,
c69d25b6-99e1-4de1-9560-73e614c6ec4d,
2a430bed-9590-4cdf-b54c-7c75036daf4c,
64e9c8ba-9d43-4487-b797-06c0682bb337
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908,
14b79b00-6d79-4199-a149-b9e11b980e76,
c109ccae-27bb-445a-ba2e-b4b347005dab,
b2d4efdd-ed26-40e0-a703-774607626ac2,
8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
5e587c18-f655-4204-a29b-c126a9ba83a5,
7d5061a3-5c01-46ab-86a7-705119ed3294,
c44c02c8-b0ac-4a7e-9292-ad1d15669220,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt', { create: true });
const stream = await fileHandle.createWritable();
await stream.write(secret);
await stream.close();
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
try {
const root = await navigator.storage.getDirectory();
const fileHandle = await root.getFileHandle('secret.txt');
const file = await fileHandle.getFile();
return file.text();
} catch (e) {
throw new Error('Unsupported');
}
}
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e,
936251c8-f2a6-49a7-9968-b62c87c4dbe6,
7ecb0b5e-06ac-4f0b-9877-13941aafa595,
2bd1c479-7336-43c9-b86e-406486807d13,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa
result, different first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
H1 connection
HTTP/1.x are the classic web connection protocols. If these connections are re-used across websites, they can be used to track users. |
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party: , , , ,
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53,
64fe2704-8adf-49ac-8923-03df5ab64bca,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true
test failed: false, false, false, true, false
|
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party: , , , ,
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908,
14b79b00-6d79-4199-a149-b9e11b980e76,
c109ccae-27bb-445a-ba2e-b4b347005dab,
b2d4efdd-ed26-40e0-a703-774607626ac2,
8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656,
a73731aa-d0e5-40fe-969b-c50b5095c0cd,
95ca9047-9f51-4aa9-b92c-24d990ff274e,
82511263-dcde-4054-875a-4f45afb136be,
a743b6b9-da56-43c3-9dd7-29de73c67576
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
5e587c18-f655-4204-a29b-c126a9ba83a5,
7d5061a3-5c01-46ab-86a7-705119ed3294,
c44c02c8-b0ac-4a7e-9292-ad1d15669220,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h1.privacytests2.org:8901/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h1.privacytests2.org:8901/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party: , , , ,
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
|
H2 connection
HTTP/2 is a web connection protocol introduced in 2015. Some browsers re-use HTTP/2 connections across websites and can thus be used to track users. |
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99,
b7de0a15-d667-44bd-b485-8711032ae50b,
b1078821-b8a3-4434-8f5a-64d3136aebfe,
19d71a06-b303-455f-971c-77cbf3e15b10,
7050dfb8-26a5-4b10-8a5f-d6638272b77e
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53,
64fe2704-8adf-49ac-8923-03df5ab64bca,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
0813080a-3a11-4d62-8333-01dfe7fbed0f,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862,
b623e490-c042-4a45-ab13-bccadc84c941,
c69d25b6-99e1-4de1-9560-73e614c6ec4d,
2a430bed-9590-4cdf-b54c-7c75036daf4c,
64e9c8ba-9d43-4487-b797-06c0682bb337
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908,
14b79b00-6d79-4199-a149-b9e11b980e76,
c109ccae-27bb-445a-ba2e-b4b347005dab,
b2d4efdd-ed26-40e0-a703-774607626ac2,
8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656,
a73731aa-d0e5-40fe-969b-c50b5095c0cd,
95ca9047-9f51-4aa9-b92c-24d990ff274e,
82511263-dcde-4054-875a-4f45afb136be,
a743b6b9-da56-43c3-9dd7-29de73c67576
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
5e587c18-f655-4204-a29b-c126a9ba83a5,
7d5061a3-5c01-46ab-86a7-705119ed3294,
c44c02c8-b0ac-4a7e-9292-ad1d15669220,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
await fetch(`https://h2.privacytests2.org:8902/?mode=write&secret=${secret}`, { cache: 'no-store' });
}
read: async () => {
const response = await fetch('https://h2.privacytests2.org:8902/?mode=read', { cache: 'no-store' });
return await response.text();
}
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e,
936251c8-f2a6-49a7-9968-b62c87c4dbe6,
7ecb0b5e-06ac-4f0b-9877-13941aafa595,
2bd1c479-7336-43c9-b86e-406486807d13,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
H3 connection
HTTP/3 is a new standard HTTP connection protocol, still in draft but widely supported by browsers. If it is not partitioned, it can be used to track users across websites. |
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party:
bd8e034722690545efc8bccd35a512d3,
5921f1df520d1bb6447da7dfcbdc997e,
61cb97d83b1958b05d286f7aa0174643,
543d01a8cd69d715d5914da2a052e280,
result, different first party: , , , ,
unsupported: false, false, false, false, true
passed: true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party: , ba8c4d35dce241a43d63fa10de749816, 542cf032cf49d5213119e9f40e632340, 004a45f7c7a5665b165a4e6510921a45, 72e754c9f88ea1528ec318541f31ed76
result, different first party: , , , ,
unsupported: true, false, false, false, false
passed: , true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party:
3aa93860f89c4b66b81aea1e6c394690,
d6513bde6cdf77c3e9b9dc75c16b8ed7,
3705d6bb1e75468129a41b6b1589e858,
eae21299e461b874760046ca1faf7ba6,
result, different first party: , , , ,
unsupported: false, false, false, false, true
passed: true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party:
661fad3fdb95a8366ac1b70525ec7724,
9d57aa5619ebaf7b9f626ac9352092d5,
4c15a25c9b3ce2f53a8a914d27055ef9,
f1159277c775e630b29f0bed076c4e15,
result, different first party: , , , ,
unsupported: false, false, false, false, true
passed: true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party:
4ca47325669f2dab7c043ef720ff76a4,
34c1ea8e06a9e5ba00653142bbbcd0a1,
dea7353712a22c256bdfe6c36025778a,
5ed87b98fc94dc3296871e226b0e4a71,
result, different first party: , , , ,
unsupported: false, false, false, false, true
passed: true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party: , , , ,
result, different first party: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party:
7d53499746f0fa287f48ab2235d8debb,
f720d4250dae952ccd6b779a5aac807b,
447ed4a19c80c892fe6cdbe2b989d84f,
41dcfb07690a8352a43976b87a7725e8,
result, different first party: , , , ,
unsupported: false, false, false, false, true
passed: true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Ensure that we can switch over to h3 via alt-svc:
for (let i = 0; i < 3; ++i) {
await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
await sleepMs(500);
}
// Are we now connecting over h3?
const response = await fetch('https://h3.privacytests2.org:4434/connection_id', { cache: 'no-store' });
const text = await response.text();
// Empty response text indicates we are not connecting over h3:
if (text.trim() === '') {
throw new Error('Unsupported');
}
}
read: async () => {
const response = await fetch('https://h3.privacytests2.org:4434/connection_id');
return await response.text();
}
result, same first party:
eafd39bdeface36efcdb166165c2b713,
a951b5f73b63fdeaeb301c1ca1a503fe,
500af39250406b26c03d5fb7736c48e9,
6094a2b04820df2807af364e6a411742,
result, different first party: , , , ,
unsupported: false, false, false, false, true
passed: true, true, true, true
test failed: false, false, false, false, false
|
|
HSTS cache
The HTTP Strict-Transport-Security response header allows a website to signal that it should only be accessed via HTTPS. The browser remembers this directive in a database, but if this database is not partitioned, then it can be used to track users across websites." |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Used http, Used http, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, true, true, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
|
HSTS cache (fetch)
The HTTP Strict-Transport-Security response header allows a website to signal that it should only be accessed via HTTPS. The browser remembers this directive in a database, but if this database is not partitioned, then it can be used to track users across websites." |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Used http, Used http, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, true, true, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
write: set HSTS flag read: read HSTS flag result, same first party: not tested, not tested, not tested, not tested, not tested result, different first party: Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https, Upgraded to https unsupported: false, false, false, false, false passed: false, false, false, false, false test failed: false, false, false, false, false |
|
iframe cache
An iframe is an element in a web page than allows websites to embed a second web page. Caching of this web page could be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
image cache
Caching of images in web browsers is a standard behavior. But if that cache leaks between websites, it can be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
indexedDB
The IndexedDB API exposes a transactional database to web pages. That database can be used to track users across websites, unless it is partitioned. |
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99,
b7de0a15-d667-44bd-b485-8711032ae50b,
b1078821-b8a3-4434-8f5a-64d3136aebfe,
19d71a06-b303-455f-971c-77cbf3e15b10,
7050dfb8-26a5-4b10-8a5f-d6638272b77e
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53,
64fe2704-8adf-49ac-8923-03df5ab64bca,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
0813080a-3a11-4d62-8333-01dfe7fbed0f,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862,
b623e490-c042-4a45-ab13-bccadc84c941,
c69d25b6-99e1-4de1-9560-73e614c6ec4d,
2a430bed-9590-4cdf-b54c-7c75036daf4c,
64e9c8ba-9d43-4487-b797-06c0682bb337
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908,
14b79b00-6d79-4199-a149-b9e11b980e76,
c109ccae-27bb-445a-ba2e-b4b347005dab,
b2d4efdd-ed26-40e0-a703-774607626ac2,
8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656,
a73731aa-d0e5-40fe-969b-c50b5095c0cd,
95ca9047-9f51-4aa9-b92c-24d990ff274e,
82511263-dcde-4054-875a-4f45afb136be,
a743b6b9-da56-43c3-9dd7-29de73c67576
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
5e587c18-f655-4204-a29b-c126a9ba83a5,
7d5061a3-5c01-46ab-86a7-705119ed3294,
c44c02c8-b0ac-4a7e-9292-ad1d15669220,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e,
936251c8-f2a6-49a7-9968-b62c87c4dbe6,
7ecb0b5e-06ac-4f0b-9877-13941aafa595,
2bd1c479-7336-43c9-b86e-406486807d13,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa
result, different first party: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
localStorage
The localStorage API gives websites access to a key-value database that will remain available across visits. If the localStorage API is not partitioned or blocked, it can also be used to track users across websites. |
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99,
b7de0a15-d667-44bd-b485-8711032ae50b,
b1078821-b8a3-4434-8f5a-64d3136aebfe,
19d71a06-b303-455f-971c-77cbf3e15b10,
7050dfb8-26a5-4b10-8a5f-d6638272b77e
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53,
64fe2704-8adf-49ac-8923-03df5ab64bca,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
0813080a-3a11-4d62-8333-01dfe7fbed0f,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862,
b623e490-c042-4a45-ab13-bccadc84c941,
c69d25b6-99e1-4de1-9560-73e614c6ec4d,
2a430bed-9590-4cdf-b54c-7c75036daf4c,
64e9c8ba-9d43-4487-b797-06c0682bb337
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908,
14b79b00-6d79-4199-a149-b9e11b980e76,
c109ccae-27bb-445a-ba2e-b4b347005dab,
b2d4efdd-ed26-40e0-a703-774607626ac2,
8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656,
a73731aa-d0e5-40fe-969b-c50b5095c0cd,
95ca9047-9f51-4aa9-b92c-24d990ff274e,
82511263-dcde-4054-875a-4f45afb136be,
a743b6b9-da56-43c3-9dd7-29de73c67576
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
5e587c18-f655-4204-a29b-c126a9ba83a5,
7d5061a3-5c01-46ab-86a7-705119ed3294,
c44c02c8-b0ac-4a7e-9292-ad1d15669220,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e,
936251c8-f2a6-49a7-9968-b62c87c4dbe6,
7ecb0b5e-06ac-4f0b-9877-13941aafa595,
2bd1c479-7336-43c9-b86e-406486807d13,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
locks
navigator.locks (only supported in some browsers) allows scripts on multiple tabs to coordinate. If this API is not partitioned, it can be used for cross-site tracking. |
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
write: async (key) => {
if (navigator.locks) {
navigator.locks.request(key, lock => new Promise((resolve) => {}));
const queryResult = await navigator.locks.query();
return queryResult.held[0].clientId;
} else {
throw new Error('Unsupported');
}
}
read: async () => {
if (navigator.locks) {
const queryResult = await navigator.locks.query();
return queryResult.held[0].name;
}
}
result, same first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
result, different first party:
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name'),
Error: undefined is not an object (evaluating 'queryResult.held[0].name')
unsupported: false, false, false, false, false
passed: undefined
test failed: true, true, true, true, true
|
|
prefetch cache
A <link rel='prefetch'...> suggests to browsers they should fetch a resource ahead of time and cache it. But if browsers don't partition this cache, it can be used to track users across websites. |
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different first party:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
script cache
Caching of scripts in web browsers is a standard behavior. But if that cache leaks between websites, it can be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
SharedWorker
The SharedWorker API allows scripts from multiple tabs to share a background thread of computation. If SharedWorker is not partitioned, then it can be abused to shared data between websites in your browser. |
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
// console.log("worker", worker);
const messagePromise = new Promise((resolve) => {
worker.port.onmessage = (e) => resolve(e.data);
});
worker.port.postMessage(secret);
await messagePromise;
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const worker = new window.SharedWorker('supercookies_sharedworker.js');
worker.port.start();
const messagePromise = new Promise((resolve, reject) => {
worker.port.onmessage = (e) => resolve(e.data);
setTimeout(() => reject(new Error('no SharedWorker message received')), 200);
});
worker.port.postMessage('request');
const message = await messagePromise;
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same' && message === 'none') {
throw new Error('Unsupported');
}
return message;
}
result, same first party:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
result, different first party: none, none, none, none, none
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
TLS Session ID
The TLS protocol is used by HTTPS to make connections secure. If the browser were to re-use a TLS session, then the session ID could be used to track users across websites. |
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
a22e7b16072fb0d70b2a3bac22153ff1c2c3185a3a6325c66e4e614b92866c2e,
2dc9cf3c28097e70a43db77d116d98b0ab9b74792d852e98d558e1e6cff75a2d,
88272a2d281dcd1e1736c16a31d62ae76e03446b46f4d5a8e6f642086d310be9,
ad76627df680b06598f63b6fe1083d25118a2a638bf44a279d573abca1ffebe9,
5d40bd536595934be18985fa79db447db430866822a977350cc715205f8ffaf9
result, different first party:
d91d5b0151606e9e7adb428d35f3107ed68995332512d97c7f140136efa7d396,
5e17ac4b6d3e210a398a643290156c694f1653d0eca8aea109d835ea91ba4962,
9fb8bfd365114188d23208b426ceedf1f53a49feb5ed86d422c567fa7cab467e,
13f21b7190c01ee6fad8693757acda6f61b40820bff2591bb437cf303c4e7f4e,
9708538397cf25ca085ddd4baa38729e149d2d7eb0e34ba7079b6afed90f9da9
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
ea0ad326f7f7f747e0274f83c9e38c7fb3511a47debdac3d75764f36d33563fa,
db8fd929433e37f48145dbccb7fcd202f89818bf86f146bc441061040b8eea30,
345c626280c9d0b40f53799d6306c6622e75ddb23ff0b9279c575869261f867f,
4b69564daa03f206669abeb45fc98678994def13ca2d4b1422919baf81989917,
be873f18a170e821d320bc31798e1473f3fb3806e06a379fe2bd02a6030a358d
result, different first party:
a17420b152c0e92522626430a613b96aeb9c6b504f9a22cbf28427badd6fb2b9,
5f4cec5777f42226453a24e4468b4310eb7755742ff8e62a4044fb8f38fec421,
9b44f5b63c3ce643d8f117a7b737d13f1f8068c1ea7c80602d981b75850d6533,
e7fcbfc5cbb314d2a1446f5c61a2ca6130c74f8fe4bdeff318c240b0187dc785,
b5316e644b397a8fcdd1fffbb1fb5487787f86a69784645386a0392da5c4138a
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
1b1dbbd5e2cf77cfd42ff50219cc7cc52b472295da7b5de5add9487d9327d104,
5f647bad2e6cbe5d1c399298db50006cd480057f00d9089d974c7b965552199e,
1c5ec46eb44832f73398f8f8a9bd8963e54ca44520c7ffff1211e27b185b3535,
544c338aa5e71069862010f235492d43b31bd5cfd9ede739c0c52d7fc2753050,
95b17dc81cf48a2dee659cc4377a7f78ad15251566e01bf732d7861cf7b680d7
result, different first party:
d82764051a2f93b39455d1b86eea073439bcda8afefea2995041bf9cae8d975f,
23b61424f83cbb67d2119289a75f1b1eba2eb36216e2888c98830b08a33a1aad,
a91c74f72777dd0ef6db5d370c35a9670031bab857b1ea5dd179a23855f1fd5d,
22508c5120a2796c1c9177ba67f1eccb987af2d8939e186ecce8291c2078fe3a,
bce601970eaf72c1e933b281d261e171c8028f788b057147febb660432308a3e
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
797e3bba52feab76ce950ea89f8072f1953ae26628b8c3dc8a1c156517be5134,
e879b3e3ef0f309d43f6ccf45998aea3fd242890d1e66f39f27703a93299c18b,
9092664a15f2a76fe7ae1b6d9f3a4511eebc835949c2968604758023d7a01e16,
fe888ddfdc9d892e5ab4e9b188e9ce194c71cdabc28a9bc89c2556d1efe4d549,
dc2b9ba9c94d4dbed0092dbb0251f3d55be45d3b707044de16574d30087860fc
result, different first party:
b95f35555fbef461337c61d2b9694a4fe83eff990ac2990b29f31e084785887e,
8c224baeac34c316248442d597164aa7e26b474e8965598ccc9933357e69654c,
3086f47c9976bef9057c0afbb5aaed2d3d78ebff100547b2bad3c4c7355c1bb9,
1558e9d679179d0280427ce74962ffb7f14dbdf089db788c021346c78528dd3b,
2b2995e82038962bec6772e10921e08243d475b6853581a236c9bc273c486d14
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
4b334c31c3c6bfc33314503105fcbc554da1640d488d4f7da3006543ba4954e0,
1f5f64c3b9a3f6403a4b4d78e0396e417f84aa6dae9b37b031298fbab73c73d1,
6c8fc2c7bd816e361b92030291465dd2bf853f27d5e48e081f9734c17106683f,
4ca378b13b696e08e823b0fc80ceaa0a658b1c71cb488347cf8ba554f8950279,
2a0bfab57db8fd01b0a1df8730e538ea4e7dfc940462e8a724d8838c87cc4610
result, different first party:
f04753c17f67c80236678773f6f79d2307a8aa1b0d72c56eb5226f51fce9a65a,
42d128ea8f52f1fd7cba6eba563265fdb37fbf25214a5a663970d67a2df46567,
e7870aeeb372a4d8c9dc3d6259dd53632fd0fa131cc3edf3f41095126c2f4a37,
5085185b8c8a2ce93f9d025eb8d343e02911372ce32f4cdf8971224540aca63c,
950181d32afc69e50b8efe07502a2f348fd2989470ad5e34f21f0d53966bb669
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
d1aba557ecaa0b81d625a1a1dd6dced112bb971e6a623e13c58d4197e4de8ee6,
c45c487744970e7b1411daf22e069597689b8c8117ed91f7c61ed7368dc5e7ec,
89d0f22be7e8edae09febf7e715b6b917dbca201dcba986d021be2cd623a6c81,
a9a26d40847b32d270febdf24e401d001480f10b88f8f96695ba2ab6a9f32ddd,
e5c584793eeb8eba026de8ad1e7fa9d43e46ff2ded6624075a2fd74e93c862f1
result, different first party:
5bc3eaf8838cd9cda3266ad60c44b0ec69f4abf2110afb4086f44d8d64d76ea9,
bfb592817e9b8709c7ce01b20afab33989f04d69f83fea8f0aaa52f83c4e7394,
b0a10f027bc95e9c8d974b5385ec8658e85e95c20876f4a8e93049baea9ba6c5,
a644e06d7e949693e27f752da07479cb568027b21c161261de7d74b4f2854223,
2a1a404dd00b76fab4076f851c101ae2dfa6fcbc65fb6d5303f6c21b73dad8d8
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
c69413117a37177dc5bb786e6494de3b859a1db33c9339029d869116922634bc,
9ebc64cde626f3f24a3eb9a8326d3f733c83f39e10f0352d0cb73b3381cb178f,
f5b32cc664b1f5beafdcd831d5d8581abfb2341afb2c7a4c8e9de84d1574ac66,
00b69acf5d4ef5d2463645d7b7d3d7e072917b7147f03483ec367a8d8ce3d926,
243cdeda7ed9c028cef2636d6521445fd6fe1f83fa274cb533839f31a5256336
result, different first party:
53b882d6224b00df769c48d11b750cce41ec2d41d793a4cd45f35e61f4e76393,
ac7532ea2dcd8feb8addbdcd4aefbf0d0751edd6416524272a108c4b053e510b,
24ecddde751ac26b251df332f03997539627ec9b728cf96ba4e628665ab7c2f6,
9e65846972d939d0356108f30dd79279cc205a91073a7b035b048b42bd01e53f,
a1570d044a601251147ae096b5711aaf95919802e658c6f19e84afc1e310b468
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
read: async () => {
const results = await fetch('https://tls.privacytests2.org:8900/');
return (await results.json()).sessionId;
}
result, same first party:
23471f8f2abd6ba9163c00a85dd7ac7d7e2212d268d2bb20af05e15f90727e66,
3503650c02339e936ab54e5b5295b43c6559cf3fa04c7cfb99a47cd95588ca9f,
0e32634d0fb3eb5441aad3aa41ef2c7ee8aad0ff87a3eeec5160fab21d57c76c,
72c23b42c5bbd53507222ebd3de6f147e4ee089740f04e009ae0808419477051,
3a16dfa9665c502b8005266d763c3585ec446363d365b06c5bfbf111e4507d6e
result, different first party:
bdf222c226c87404798c5ef834e0778e5ca6aa57a222e8f692aae0f1badda140,
5edf03faf94d9b9867a42a088cbbd7728d489b5cac9d913359783a93a0d7878c,
ae14913908b0fb6889c43af415a398c13fced65f775b9a23e06f5d5826675724,
7afc98226fb35d20965789048c79dc6b233e25fe9a1c0708b1753bee1b9c6b43,
79b73b714f985df447f3bef06a4206e36306a4d9a81517d6387318e189025c18
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
XMLHttpRequest cache
Similar to the newer Fetch API, any resource received may be cached by the browser. The cache is potentially vulnerable to cross-site tracking attack. |
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same first party: 1, 1, 1, 1, 1
result, different first party: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
Navigation testsWhich browsers prevent websites from sharing tracking data when you click on a link?
When you click a hyperlink to navigate your browser from one site to another, certain browser APIs allow the first site to communicate to the second site. These privacy vulnerabilities can be fixed by introducing new limits on how much data is transfered between sites.', |
||||||||
|
document.referrer
The Referer [sic] request header is a mechanism used by browsers to let a website know where the user is visiting from. This header is inherently tracking users across websites. In recent times, browsers have switched to a policy of trimming a referrer to convey less tracking information, but Referer continues to convey cross-site tracking data by default. |
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { /* do nothing */ }
read: () => document.referrer
result, same first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
result, different first party:
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/,
https://test-pages.privacytests2.org/
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
sessionStorage
The sessionStorage API is similar to the localStorage API, but it does not persist across tabs or across browser sessions. Nonetheless, it can be used to track users if they navigate from one website to another. This tracking can be thwarted by partitioning sessionStorage between websites. |
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
2bbe5904-9b53-42c2-a9ec-37926527b6a2,
64f65157-4029-4cca-a826-90689e865af8,
3420a7ac-77f9-4a2d-916b-be77167b1cd7,
99fd256d-4878-40ed-93ae-ee6150a82b84,
ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
efab9cc2-8119-4324-a177-b86f7091dd99,
b7de0a15-d667-44bd-b485-8711032ae50b,
b1078821-b8a3-4434-8f5a-64d3136aebfe,
19d71a06-b303-455f-971c-77cbf3e15b10,
7050dfb8-26a5-4b10-8a5f-d6638272b77e
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
98629a13-db8e-4bf8-9c50-dff4d8f74e53,
64fe2704-8adf-49ac-8923-03df5ab64bca,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
0813080a-3a11-4d62-8333-01dfe7fbed0f,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
6ea78a58-0774-4928-ad83-403894d34862,
b623e490-c042-4a45-ab13-bccadc84c941,
c69d25b6-99e1-4de1-9560-73e614c6ec4d,
2a430bed-9590-4cdf-b54c-7c75036daf4c,
64e9c8ba-9d43-4487-b797-06c0682bb337
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
0fbc05bc-5d40-448a-8a42-2a2b789cc908,
14b79b00-6d79-4199-a149-b9e11b980e76,
c109ccae-27bb-445a-ba2e-b4b347005dab,
b2d4efdd-ed26-40e0-a703-774607626ac2,
8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
f94a6cdf-6a70-46f5-8102-8281c0fd4656,
a73731aa-d0e5-40fe-969b-c50b5095c0cd,
95ca9047-9f51-4aa9-b92c-24d990ff274e,
82511263-dcde-4054-875a-4f45afb136be,
a743b6b9-da56-43c3-9dd7-29de73c67576
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
5e587c18-f655-4204-a29b-c126a9ba83a5,
7d5061a3-5c01-46ab-86a7-705119ed3294,
c44c02c8-b0ac-4a7e-9292-ad1d15669220,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => window.sessionStorage.setItem('secret', secret)
read: () => window.sessionStorage.getItem('secret')
result, same first party:
e81b4cbb-6161-4f61-8e06-41396b557c7e,
936251c8-f2a6-49a7-9968-b62c87c4dbe6,
7ecb0b5e-06ac-4f0b-9877-13941aafa595,
2bd1c479-7336-43c9-b86e-406486807d13,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
window.name
The window.name API allows websites to store data that will persist after the user has navigated the tab to a different website. This mechanism could be partitioned so that data is not allowed to persist between websites. |
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_2bbe5904-9b53-42c2-a9ec-37926527b6a2,
name_64f65157-4029-4cca-a826-90689e865af8,
name_3420a7ac-77f9-4a2d-916b-be77167b1cd7,
name_99fd256d-4878-40ed-93ae-ee6150a82b84,
name_ef6f996a-ad7d-48ba-be85-1035b0879537
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_efab9cc2-8119-4324-a177-b86f7091dd99,
name_b7de0a15-d667-44bd-b485-8711032ae50b,
name_b1078821-b8a3-4434-8f5a-64d3136aebfe,
name_19d71a06-b303-455f-971c-77cbf3e15b10,
name_7050dfb8-26a5-4b10-8a5f-d6638272b77e
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_98629a13-db8e-4bf8-9c50-dff4d8f74e53,
name_64fe2704-8adf-49ac-8923-03df5ab64bca,
name_a0f22366-2c4d-4d06-a06d-a5e4bf219de3,
name_0813080a-3a11-4d62-8333-01dfe7fbed0f,
name_e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_6ea78a58-0774-4928-ad83-403894d34862,
name_b623e490-c042-4a45-ab13-bccadc84c941,
name_c69d25b6-99e1-4de1-9560-73e614c6ec4d,
name_2a430bed-9590-4cdf-b54c-7c75036daf4c,
name_64e9c8ba-9d43-4487-b797-06c0682bb337
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_0fbc05bc-5d40-448a-8a42-2a2b789cc908,
name_14b79b00-6d79-4199-a149-b9e11b980e76,
name_c109ccae-27bb-445a-ba2e-b4b347005dab,
name_b2d4efdd-ed26-40e0-a703-774607626ac2,
name_8e293932-ee92-4938-8bf4-98ed034e24a2
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_f94a6cdf-6a70-46f5-8102-8281c0fd4656,
name_a73731aa-d0e5-40fe-969b-c50b5095c0cd,
name_95ca9047-9f51-4aa9-b92c-24d990ff274e,
name_82511263-dcde-4054-875a-4f45afb136be,
name_a743b6b9-da56-43c3-9dd7-29de73c67576
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_39f1b1ff-adc0-4bf7-ae37-63aa9be978ff,
name_5e587c18-f655-4204-a29b-c126a9ba83a5,
name_7d5061a3-5c01-46ab-86a7-705119ed3294,
name_c44c02c8-b0ac-4a7e-9292-ad1d15669220,
name_c0d8f011-fb3f-43ba-b8b2-a02ddc13094f
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.name = 'name_' + secret; }
read: () => window.name
result, same first party:
name_e81b4cbb-6161-4f61-8e06-41396b557c7e,
name_936251c8-f2a6-49a7-9968-b62c87c4dbe6,
name_7ecb0b5e-06ac-4f0b-9877-13941aafa595,
name_2bd1c479-7336-43c9-b86e-406486807d13,
name_08a71f8d-bda4-42f9-8d2c-8d106710d9aa
result, different first party: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
HTTPS testsWhich browsers prevent unencrypted network connections?
HTTPS is the protocol that web browsers use to connect securely to websites. When HTTPS is being used, the connection is encrypted so that third parties on the network cannot read content being sent between the server and your browser. In the past, insecure connections were the default and websites would need to actively request that a browser use HTTPS. Now the status quo is shifting, and browser makers are moving toward a world where HTTPS is the default protocol.` |
||||||||
|
Insecure website warning
Checks to see if the browser stops loading an insecure website and warns the user before giving them the option to continue. Known as HTTPS-Only Mode in some browsers. |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
passed: false, false, false, false, false result: Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded, Insecure website loaded |
|
Upgradable address
Checks to see if an insecure address entered into the browser's address bar is upgraded to HTTPS whenever possible. |
upgraded: true, true, true, true, true passed: true, true, true, true, true |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
|
Upgradable hyperlink
Checks to see if the user has clicked on a hyperlink to an insecure address, if the browser upgrades that address to HTTPS whenever possible. |
upgraded: true, true, true, true, true passed: true, true, true, true, true |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
upgraded: true, true, true, true, true passed: true, true, true, true, true |
upgraded: false, false, false, false, false passed: false, false, false, false, false |
|
Upgradable image
Checks to see if the browser attempts to upgrade an insecure address for an image to HTTPS whenever possible. |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
passed: true, true, true, true, true result: upgraded, upgraded, upgraded, upgraded, upgraded |
|
Upgradable script
Checks to see if the browser attempts to upgrade an insecure address for an script to HTTPS whenever possible. |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
passed: true, true, true, true, true result: blocked, blocked, blocked, blocked, blocked |
|
Misc testsWhich browsers provide additional assorted privacy protections?
This category includes tests for the presence of miscellaneous privacy features |
||||||||
|
ECH enabled
Encrypted Client Hello (ECH) is a new protocol that hides the website you are visiting from third-party network eavesdroppers. |
SNI_status: plaintext passed: false, false, false, false, false |
SNI_status: plaintext passed: false, false, false, false, false |
SNI_status: plaintext passed: false, false, false, false, false |
SNI_status: plaintext passed: false, false, false, false, false |
SNI_status: plaintext passed: false, false, false, false, false |
SNI_status: plaintext passed: false, false, false, false, false |
SNI_status: plaintext passed: false, false, false, false, false |
SNI_status: plaintext passed: false, false, false, false, false |
|
GPC enabled first-party
The Global Privacy Control is an HTTP header that can be sent by a browser to instruct a website not to sell the user's personal data to third parties. This test checks to see if the GPC header is sent by default to the top-level website. |
header value: undefined passed: false, false, false, false, false |
header value: undefined passed: false, false, false, false, false |
header value: 1 passed: true, true, true, true, true |
header value: undefined passed: false, false, false, false, false |
header value: undefined passed: false, false, false, false, false |
header value: undefined passed: false, false, false, false, false |
header value: undefined passed: false, false, false, false, false |
header value: undefined passed: false, false, false, false, false |
|
GPC enabled third-party
The Global Privacy Control is an HTTP header that can be sent by a browser to instruct a visited website not to sell the user's personal data to other parties. This test checks to see if the GPC header is sent to third-party elements on the web page. |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
|
IP address hidden
IP addresses can be used to uniquely identify a large percentage of users. A proxy, VPN, or Tor can mask a user's IP address. |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
passed: false, false, false, false, false |
|
Stream isolation
Browsers that use Tor can use a different Tor circuit per top-level website. |
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
write: () => {
if (!usingTor) {
throw new Error('Unsupported');
}
}
read: async () => {
if (usingTor) {
return ipAddress;
} else {
throw new Error('Unsupported');
}
}
unsupported: true, true, true, true, true
readSameFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
readDifferentFirstParty:
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported,
Error: Unsupported
testFailed: false, false, false, false, false
|
|
Tor enabled
The Tor network sends the browser's web requests through a series of relays to hide a user's IP address, thereby helping to mask their identity and location. This test checks to see if the Tor network is being used by default. |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
IsTorExit: false, false, false, false, false passed: false, false, false, false, false |
|
Tracking query parameter testsWhich browsers remove URL parameters that can track you?
When you browse from one web page to another, tracking companies will frequently attach a 'tracking query parameter' to the address of the second web page. That query parameter may contain a unique identifier that tracks you individually as you browse the web. And these query parameters are frequently synchronized with cookies, making them a powerful tracking vector. Web browsers can protect you from known tracking query parameters by stripping them from web addresses before your browser sends them. (The set of tracking query parameters tested here was largely borrowed from Brave.)` |
||||||||
|
__hsfp
HubSpot tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
__hssc
HubSpot tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
__hstc
HubSpot tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
__s
Drip.com email address tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
_hsenc
HubSpot tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
_openstat
Yandex tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
dclid
DoubleClick Click ID (Google) |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
fbclid
Facebook Click Identifier |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
gclid
Google Click Identifier |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
hsCtaTracking
HubSpot tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
mc_eid
Mailchimp Email ID (email recipient's address) |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
mkt_tok
Adobe Marketo tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
ml_subscriber
MailerLite email tracking |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
ml_subscriber_hash
MailerLite email tracking |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
msclkid
Microsoft Click ID |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
oly_anon_id
Omeda marketing 'anonymous' customer id |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
oly_enc_id
Omeda marketing 'known' customer id |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
rb_clickid
Unknown high-entropy tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
s_cid
Adobe Site Catalyst tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
vero_conv
Vero tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
vero_id
Vero tracking parameter |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
wickedid
Wicked Reports e-commerce tracking |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
yclid
Yandex Click ID |
passed: true, true, true, true, true |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
value: 5388749818657461 passed: false, false, false, false, false |
|
Tracker content blocking testsWhich browsers block important known tracking scripts and pixels?
When you visit a web page, it frequently has third-party embedded tracking content, such as scripts and tracking pixels. These embedded components spy on you. Some browsers and browser extensions maintain list of tracking companies and block their content from being loaded. This section checks to see if a browser blocks 20 of the largest trackers listed by https://whotracks.me.` |
||||||||
|
Adobe
Tests whether the browser blocks the page from loading the tracker at https://munchkin.marketo.net/munchkin.js |
url: https://munchkin.marketo.net/munchkin.js passed: true, true, true, true, true |
url: https://munchkin.marketo.net/munchkin.js passed: , false |
url: https://munchkin.marketo.net/munchkin.js passed: true, true, true, true, true |
url: https://munchkin.marketo.net/munchkin.js passed: , false, false |
url: https://munchkin.marketo.net/munchkin.js |
url: https://munchkin.marketo.net/munchkin.js passed: true, true, true, true, true |
url: https://munchkin.marketo.net/munchkin.js |
url: https://munchkin.marketo.net/munchkin.js |
|
Adobe Audience Manager
Tests whether the browser blocks the page from loading the tracker at https://dpm.demdex.net/ibs |
url: https://dpm.demdex.net/ibs passed: true, true, true, true, true |
url: https://dpm.demdex.net/ibs passed: false, false, false |
url: https://dpm.demdex.net/ibs passed: true, true, true, true, true |
url: https://dpm.demdex.net/ibs passed: false, false, false, false, false |
url: https://dpm.demdex.net/ibs passed: , false, false |
url: https://dpm.demdex.net/ibs passed: true, true, true, true, true |
url: https://dpm.demdex.net/ibs passed: , false, false, false |
url: https://dpm.demdex.net/ibs passed: false, false, false, false |
|
Amazon adsystem
Tests whether the browser blocks the page from loading the tracker at https://s.amazon-adsystem.com/dcm |
url: https://s.amazon-adsystem.com/dcm passed: true, true, true, true, true |
url: https://s.amazon-adsystem.com/dcm passed: false, false |
url: https://s.amazon-adsystem.com/dcm passed: true, true, true, true, true |
url: https://s.amazon-adsystem.com/dcm passed: false, false, false, false |
url: https://s.amazon-adsystem.com/dcm passed: , false, false |
url: https://s.amazon-adsystem.com/dcm passed: true, true, true, true, true |
url: https://s.amazon-adsystem.com/dcm passed: , false, false |
url: https://s.amazon-adsystem.com/dcm passed: false, false, false, false |
|
AppNexus
Tests whether the browser blocks the page from loading the tracker at https://ib.adnxs.com/px?id=178248&t=1 |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: true, true, true, true, true |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: false, false, false |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: true, true, true, true, true |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: false, false, false, false, false |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: , false, false |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: true, true, true, true, true |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: , false |
url: https://ib.adnxs.com/px?id=178248&t=1 passed: false, false, false, false |
|
Bing Ads
Tests whether the browser blocks the page from loading the tracker at https://bat.bing.com/bat.js |
url: https://bat.bing.com/bat.js passed: true, true, true, true, true |
url: https://bat.bing.com/bat.js passed: false, false, false |
url: https://bat.bing.com/bat.js passed: true, true, true, true, true |
url: https://bat.bing.com/bat.js passed: false, false, false, false, false |
url: https://bat.bing.com/bat.js passed: , false, false |
url: https://bat.bing.com/bat.js |
url: https://bat.bing.com/bat.js passed: false, false, false, false, false |
url: https://bat.bing.com/bat.js passed: false, false, false, false |
|
Chartbeat
Tests whether the browser blocks the page from loading the tracker at https://static.chartbeat.com/js/chartbeat.js |
url: https://static.chartbeat.com/js/chartbeat.js passed: true, true, true, true, true |
url: https://static.chartbeat.com/js/chartbeat.js passed: false, false, false, false, false |
url: https://static.chartbeat.com/js/chartbeat.js passed: false, false, false, false, false |
url: https://static.chartbeat.com/js/chartbeat.js passed: false, false, false, false, false |
url: https://static.chartbeat.com/js/chartbeat.js passed: false, false, false, false, false |
url: https://static.chartbeat.com/js/chartbeat.js passed: true, true, true, true, true |
url: https://static.chartbeat.com/js/chartbeat.js passed: false, false, false, false, false |
url: https://static.chartbeat.com/js/chartbeat.js passed: false, false, false, false, false |
|
Criteo
Tests whether the browser blocks the page from loading the tracker at https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: true, true, true, true, true |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: false, false, false |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: true, true, true, true, true |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: false, false, false, false, false |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: , false, false |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: true, true, true, true, true |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: , false |
url: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx passed: false, false, false, false, false |
|
DoubleClick (Google)
Tests whether the browser blocks the page from loading the tracker at https://securepubads.g.doubleclick.net/static/glade.js |
url: https://securepubads.g.doubleclick.net/static/glade.js passed: true, true, true, true, true |
url: https://securepubads.g.doubleclick.net/static/glade.js |
url: https://securepubads.g.doubleclick.net/static/glade.js passed: true, true, true, true, true |
url: https://securepubads.g.doubleclick.net/static/glade.js |
url: https://securepubads.g.doubleclick.net/static/glade.js |
url: https://securepubads.g.doubleclick.net/static/glade.js passed: true, true, true, true, true |
url: https://securepubads.g.doubleclick.net/static/glade.js |
url: https://securepubads.g.doubleclick.net/static/glade.js |
|
Facebook tracking
Tests whether the browser blocks the page from loading the tracker at https://connect.facebook.net/en_US/fbevents.js |
url: https://connect.facebook.net/en_US/fbevents.js passed: true, true, true, true, true |
url: https://connect.facebook.net/en_US/fbevents.js passed: false, false, false, false, false |
url: https://connect.facebook.net/en_US/fbevents.js passed: true, true, true, true, true |
url: https://connect.facebook.net/en_US/fbevents.js passed: false, false, false, false, false |
url: https://connect.facebook.net/en_US/fbevents.js passed: false, false, false, false, false |
url: https://connect.facebook.net/en_US/fbevents.js passed: true, true, true, true, true |
url: https://connect.facebook.net/en_US/fbevents.js passed: false, false, false, false, false |
url: https://connect.facebook.net/en_US/fbevents.js passed: false, false, false, false, false |
|
Google (third-party ad pixel)
Tests whether the browser blocks the page from loading the tracker at https://www.google.com/pagead/1p-user-list/ |
url: https://www.google.com/pagead/1p-user-list/ passed: true, true, true, true, true |
url: https://www.google.com/pagead/1p-user-list/ |
url: https://www.google.com/pagead/1p-user-list/ passed: true, true, true, true, true |
url: https://www.google.com/pagead/1p-user-list/ |
url: https://www.google.com/pagead/1p-user-list/ |
url: https://www.google.com/pagead/1p-user-list/ |
url: https://www.google.com/pagead/1p-user-list/ passed: , false |
url: https://www.google.com/pagead/1p-user-list/ |
|
Google Analytics
Tests whether the browser blocks the page from loading the tracker at https://google-analytics.com/urchin.js |
url: https://google-analytics.com/urchin.js passed: true, true, true, true, true |
url: https://google-analytics.com/urchin.js |
url: https://google-analytics.com/urchin.js passed: true, true, true, true, true |
url: https://google-analytics.com/urchin.js |
url: https://google-analytics.com/urchin.js |
url: https://google-analytics.com/urchin.js passed: true, true, true, true, true |
url: https://google-analytics.com/urchin.js passed: , false |
url: https://google-analytics.com/urchin.js |
|
Google Tag Manager
Tests whether the browser blocks the page from loading the tracker at https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL passed: true, true, true, true, true |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL passed: , false, false |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL passed: true, true, true, true, true |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL passed: false, false |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL passed: false, false |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL passed: false, false, false, false, false |
url: https://www.googletagmanager.com/gtag.js?id=GTM-NX4SMZL passed: false, false, false |
|
Index Exchange
Tests whether the browser blocks the page from loading the tracker at https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 passed: true, true, true, true, true |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 passed: true, true, true, true, true |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 passed: , false |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 passed: true, true, true, true, true |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 |
url: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=10&external_user_id=629685505537&C=1 passed: false |
|
New Relic
Tests whether the browser blocks the page from loading the tracker at https://js-agent.newrelic.com/nr-1212.min.js |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: true, true, true, true, true |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: false, false, false, false, false |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: true, true, true, true, true |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: false, false, false, false, false |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: false, false, false, false, false |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: true, true, true, true, true |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: false, false, false, false, false |
url: https://js-agent.newrelic.com/nr-1212.min.js passed: false, false, false, false, false |
|
Quantcast
Tests whether the browser blocks the page from loading the tracker at https://pixel.quantserve.com/pixel |
url: https://pixel.quantserve.com/pixel |
url: https://pixel.quantserve.com/pixel passed: false, false, false |
url: https://pixel.quantserve.com/pixel passed: true, true, true, true, true |
url: https://pixel.quantserve.com/pixel passed: false, false, false, false |
url: https://pixel.quantserve.com/pixel passed: , false, false |
url: https://pixel.quantserve.com/pixel passed: true, true, true, true, true |
url: https://pixel.quantserve.com/pixel passed: false, false, false, false, false |
url: https://pixel.quantserve.com/pixel passed: false, false, false, false |
|
Scorecard Research Beacon
Tests whether the browser blocks the page from loading the tracker at https://sb.scorecardresearch.com/internal-c2/default/cs.js |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js passed: true, true, true, true, true |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js passed: false |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js passed: true, true, true, true, true |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js passed: , false, false |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js passed: true, true, true, true, true |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js passed: , false |
url: https://sb.scorecardresearch.com/internal-c2/default/cs.js |
|
Taboola
Tests whether the browser blocks the page from loading the tracker at https://trc.taboola.com/futureplc-tomsguide/trc/3/json |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: true, true, true, true, true |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: false, false, false, false, false |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: true, true, true, true, true |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: false, false, false, false, false |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: false, false, false, false, false |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: true, true, true, true, true |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: , false, false, false |
url: https://trc.taboola.com/futureplc-tomsguide/trc/3/json passed: false, false, false, false, false |
|
Twitter pixel
Tests whether the browser blocks the page from loading the tracker at https://t.co/i/adsct |
url: https://t.co/i/adsct passed: true, true, true, true, true |
url: https://t.co/i/adsct passed: false, false, false |
url: https://t.co/i/adsct passed: true, true, true, true, true |
url: https://t.co/i/adsct passed: false, false, false, false, false |
url: https://t.co/i/adsct passed: , false, false |
url: https://t.co/i/adsct |
url: https://t.co/i/adsct passed: , false, false |
url: https://t.co/i/adsct passed: false, false, false, false |
|
Yandex Ads
Tests whether the browser blocks the page from loading the tracker at https://yandex.ru/ads/system/header-bidding.js |
url: https://yandex.ru/ads/system/header-bidding.js passed: true, true, true, true, true |
url: https://yandex.ru/ads/system/header-bidding.js passed: false, false, false, false, false |
url: https://yandex.ru/ads/system/header-bidding.js passed: false, false, false, false, false |
url: https://yandex.ru/ads/system/header-bidding.js passed: false, false, false, false, false |
url: https://yandex.ru/ads/system/header-bidding.js passed: false, false, false, false, false |
url: https://yandex.ru/ads/system/header-bidding.js |
url: https://yandex.ru/ads/system/header-bidding.js passed: false, false, false, false, false |
url: https://yandex.ru/ads/system/header-bidding.js passed: false, false, false, false, false |
|
Cross-session first-party tracking testsWhich browsers prevent websites from tracking you across browser sessions?
A common vulnerability of web browsers is that they allow websites ("first parties") to 'tag' your browser with some tracking data. This tag can be used to re-identify you when you return to a website you visited before. This category of leaks can be prevented by browser if they clean or isolate data between browser sessions. (In cases where a user has logged into a website or entered detailed information, it may be justifiable for a browser to retain information across sessions. These tests check when no such justification exists: when you have entered no significant information into a website, will the browser still retain data that allows you to be tracked across sessions?)
|
||||||||
|
Alt-Svc
Alt-Svc allows the server to indicate to the web browser that a resource should be loaded on a different server. Because this is a persistent setting, it could be used to track users across websites if it is not correctly partitioned. |
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h3, h3, h2, h3, h3
result, different session: h3, h2, h3, h3, h3
unsupported: false, false, true, false, false
passed: false, true, false, false
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h3, h2, h3, h3, h3
result, different session: h3, h3, h3, h3, h3
unsupported: false, true, false, false, false
passed: false, false, false, false
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h3, h2, h3, h3, h3
result, different session: h2, h3, h3, h3, h3
unsupported: false, true, false, false, false
passed: true, false, false, false
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h3, h3, h3, h3
result, different session: h3, h3, h3, h3, h3
unsupported: true, false, false, false, false
passed: , false, false, false, false
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h3, h2, h3, h3, h3
result, different session: h2, h3, h3, h3, h3
unsupported: false, true, false, false, false
passed: true, false, false, false
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h3, h2, h3, h3, h3
result, different session: h2, h3, h3, h3, h3
unsupported: false, true, false, false, false
passed: true, false, false, false
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h3, h3, h3
result, different session: h2, h3, h3, h3, h3
unsupported: true, true, false, false, false
passed: , false, false, false
test failed: false, false, false, false, false
|
|
CacheStorage
The Cache API is a content storage mechanism originally introduced to support ServiceWorkers. If the same Cache object is accessible to multiple websites, it can be abused to track users. |
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_1p,
64f65157-4029-4cca-a826-90689e865af8_1p,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_1p,
99fd256d-4878-40ed-93ae-ee6150a82b84_1p,
ef6f996a-ad7d-48ba-be85-1035b0879537_1p
result, different session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_1p,
b7de0a15-d667-44bd-b485-8711032ae50b_1p,
b1078821-b8a3-4434-8f5a-64d3136aebfe_1p,
19d71a06-b303-455f-971c-77cbf3e15b10_1p,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_1p
result, different session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p
result, different session:
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p,
ebf2de62-557c-4374-bd92-c6951d45a072_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p
result, different session:
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p
result, different session:
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p,
33cff721-4f19-4384-90f7-28875626f425_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
result, different session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p
result, different session:
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p,
04952854-3358-4881-9e6e-a019dbb2b47b_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_1p,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_1p,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_1p,
2bd1c479-7336-43c9-b86e-406486807d13_1p,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_1p
result, different session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
cookie (HTTP)
The cookie, first introduced by Netscape in 1994, is a small amount of data stored by your browser on a website's behalf. It has legitimate uses, but it is also the classic cross-site tracking mechanism, and today still the most popular method of tracking users across websites. Browsers can stop cookies from being used for cross-site tracking by either blocking or partitioning them. |
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_1p_http,
64f65157-4029-4cca-a826-90689e865af8_1p_http,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_1p_http,
99fd256d-4878-40ed-93ae-ee6150a82b84_1p_http,
ef6f996a-ad7d-48ba-be85-1035b0879537_1p_http
result, different session:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_1p_http,
64f65157-4029-4cca-a826-90689e865af8_1p_http,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_1p_http,
99fd256d-4878-40ed-93ae-ee6150a82b84_1p_http,
ef6f996a-ad7d-48ba-be85-1035b0879537_1p_http
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_1p_http,
b7de0a15-d667-44bd-b485-8711032ae50b_1p_http,
b1078821-b8a3-4434-8f5a-64d3136aebfe_1p_http,
19d71a06-b303-455f-971c-77cbf3e15b10_1p_http,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_1p_http
result, different session:
efab9cc2-8119-4324-a177-b86f7091dd99_1p_http,
b7de0a15-d667-44bd-b485-8711032ae50b_1p_http,
b1078821-b8a3-4434-8f5a-64d3136aebfe_1p_http,
19d71a06-b303-455f-971c-77cbf3e15b10_1p_http,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_1p_http
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p_http,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p_http,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p_http,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p_http,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p_http
result, different session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p_http,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p_http,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p_http,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p_http,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p_http
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
6ea78a58-0774-4928-ad83-403894d34862_1p_http,
b623e490-c042-4a45-ab13-bccadc84c941_1p_http,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p_http,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p_http,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p_http
result, different session:
6ea78a58-0774-4928-ad83-403894d34862_1p_http,
b623e490-c042-4a45-ab13-bccadc84c941_1p_http,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p_http,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p_http,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p_http
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p_http,
14b79b00-6d79-4199-a149-b9e11b980e76_1p_http,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p_http,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p_http,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p_http
result, different session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p_http,
14b79b00-6d79-4199-a149-b9e11b980e76_1p_http,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p_http,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p_http,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p_http
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_1p_http,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_1p_http,
95ca9047-9f51-4aa9-b92c-24d990ff274e_1p_http,
82511263-dcde-4054-875a-4f45afb136be_1p_http,
a743b6b9-da56-43c3-9dd7-29de73c67576_1p_http
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p_http,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p_http,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p_http,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p_http,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p_http
result, different session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p_http,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p_http,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p_http,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p_http,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p_http
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_1p_http,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_1p_http,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_1p_http,
2bd1c479-7336-43c9-b86e-406486807d13_1p_http,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_1p_http
result, different session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_1p_http,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_1p_http,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_1p_http,
2bd1c479-7336-43c9-b86e-406486807d13_1p_http,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_1p_http
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
cookie (JS)
The cookie, first introduced by Netscape in 1994, is a small amount of data stored by your browser on a website's behalf. It has legitimate uses, but it is also the classic cross-site tracking mechanism, and today still the most popular method of tracking users across websites. Browsers can stop cookies from being used for cross-site tracking by either blocking or partitioning them. |
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_1p_js,
64f65157-4029-4cca-a826-90689e865af8_1p_js,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_1p_js,
99fd256d-4878-40ed-93ae-ee6150a82b84_1p_js,
ef6f996a-ad7d-48ba-be85-1035b0879537_1p_js
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_1p_js,
b7de0a15-d667-44bd-b485-8711032ae50b_1p_js,
b1078821-b8a3-4434-8f5a-64d3136aebfe_1p_js,
19d71a06-b303-455f-971c-77cbf3e15b10_1p_js,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_1p_js
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p_js,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p_js,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p_js,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p_js,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p_js
result, different session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p_js,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p_js,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p_js,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p_js,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p_js
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
6ea78a58-0774-4928-ad83-403894d34862_1p_js,
b623e490-c042-4a45-ab13-bccadc84c941_1p_js,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p_js,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p_js,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p_js
result, different session:
6ea78a58-0774-4928-ad83-403894d34862_1p_js,
b623e490-c042-4a45-ab13-bccadc84c941_1p_js,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p_js,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p_js,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p_js
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p_js,
14b79b00-6d79-4199-a149-b9e11b980e76_1p_js,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p_js,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p_js,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p_js
result, different session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p_js,
14b79b00-6d79-4199-a149-b9e11b980e76_1p_js,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p_js,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p_js,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p_js
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_1p_js,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_1p_js,
95ca9047-9f51-4aa9-b92c-24d990ff274e_1p_js,
82511263-dcde-4054-875a-4f45afb136be_1p_js,
a743b6b9-da56-43c3-9dd7-29de73c67576_1p_js
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p_js,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p_js,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p_js,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p_js,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p_js
result, different session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p_js,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p_js,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p_js,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p_js,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p_js
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_1p_js,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_1p_js,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_1p_js,
2bd1c479-7336-43c9-b86e-406486807d13_1p_js,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_1p_js
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
CookieStore
The Cookie Store API is an alternative asynchronous API for managing cookies, supported by some browsers. |
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_1p,
64f65157-4029-4cca-a826-90689e865af8_1p,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_1p,
99fd256d-4878-40ed-93ae-ee6150a82b84_1p,
ef6f996a-ad7d-48ba-be85-1035b0879537_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_1p,
b7de0a15-d667-44bd-b485-8711032ae50b_1p,
b1078821-b8a3-4434-8f5a-64d3136aebfe_1p,
19d71a06-b303-455f-971c-77cbf3e15b10_1p,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p
result, different session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
6ea78a58-0774-4928-ad83-403894d34862_1p,
b623e490-c042-4a45-ab13-bccadc84c941_1p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p
result, different session:
6ea78a58-0774-4928-ad83-403894d34862_1p,
b623e490-c042-4a45-ab13-bccadc84c941_1p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p,
14b79b00-6d79-4199-a149-b9e11b980e76_1p,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p
result, different session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p,
14b79b00-6d79-4199-a149-b9e11b980e76_1p,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_1p,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_1p,
95ca9047-9f51-4aa9-b92c-24d990ff274e_1p,
82511263-dcde-4054-875a-4f45afb136be_1p,
a743b6b9-da56-43c3-9dd7-29de73c67576_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p
result, different session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_1p,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_1p,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_1p,
2bd1c479-7336-43c9-b86e-406486807d13_1p,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
CSS cache
CSS stylesheets are cached, and if that cache is shared between websites, it can be used to track users across sites. |
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_9120745590065122,
fake_48572422201192356,
fake_26414515771173575,
fake_7769389954529451,
fake_9196755051994303
result, different session:
fake_9120745590065122,
fake_48572422201192356,
fake_26414515771173575,
fake_7769389954529451,
fake_9196755051994303
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_6868290565044364,
fake_9496271987141067,
fake_5914820051209921,
fake_8685478711347341,
fake_5084389933493509
result, different session:
fake_6868290565044364,
fake_9496271987141067,
fake_5914820051209921,
fake_8685478711347341,
fake_5084389933493509
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_15155760114436823,
fake_5340471979605883,
fake_4832680660283861,
fake_18334222082472773,
fake_7651164375378969
result, different session:
fake_15155760114436823,
fake_5340471979605883,
fake_4832680660283861,
fake_18334222082472773,
fake_7651164375378969
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_1782052939871972,
fake_06901066679442791,
fake_6722945222904326,
fake_5338074672471698,
fake_2189558547743018
result, different session:
fake_1782052939871972,
fake_06901066679442791,
fake_6722945222904326,
fake_5338074672471698,
fake_2189558547743018
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_353320986643733,
fake_7194755660827943,
fake_34419051148384905,
fake_03497384969295214,
fake_7929889825098699
result, different session:
fake_353320986643733,
fake_7194755660827943,
fake_34419051148384905,
fake_03497384969295214,
fake_7929889825098699
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_987429772160709,
fake_2303023450487771,
fake_8481448456628577,
fake_03518500589008822,
fake_9340383366668692
result, different session:
fake_37483043462220134,
fake_3404525232924147,
fake_6773008749435221,
fake_23661271665691208,
fake_708469802498064
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_40322273015909516,
fake_7457735532968488,
fake_16545534903975456,
fake_05877702502059057,
fake_4892035248522124
result, different session:
fake_40322273015909516,
fake_7457735532968488,
fake_16545534903975456,
fake_05877702502059057,
fake_4892035248522124
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_44409091812073265,
fake_9596870370788704,
fake_2318525744743296,
fake_903587967886897,
fake_49161254432573087
result, different session:
fake_44409091812073265,
fake_9596870370788704,
fake_2318525744743296,
fake_903587967886897,
fake_49161254432573087
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
favicon cache
A favicon is an icon that represents a website, typically shown in browser tab and bookmarks menu. If the favicon cache is not partitioned, it can be used to track users across websites. |
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
fetch cache
When a resource is received via the Fetch API, it is frequently cached. That cache can potentially be abused for cross-site tracking. |
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 2, 2, 2, 2, 2
result, different session: 3, 3, 3, 3, 3
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
font cache
Web fonts are sometimes stored in their own cache, which is vulnerable to being abused for cross-site tracking. |
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
iframe cache
An iframe is an element in a web page than allows websites to embed a second web page. Caching of this web page could be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
image cache
Caching of images in web browsers is a standard behavior. But if that cache leaks between websites, it can be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
indexedDB
The IndexedDB API exposes a transactional database to web pages. That database can be used to track users across websites, unless it is partitioned. |
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_1p,
64f65157-4029-4cca-a826-90689e865af8_1p,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_1p,
99fd256d-4878-40ed-93ae-ee6150a82b84_1p,
ef6f996a-ad7d-48ba-be85-1035b0879537_1p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_1p,
b7de0a15-d667-44bd-b485-8711032ae50b_1p,
b1078821-b8a3-4434-8f5a-64d3136aebfe_1p,
19d71a06-b303-455f-971c-77cbf3e15b10_1p,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_1p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p
result, different session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
6ea78a58-0774-4928-ad83-403894d34862_1p,
b623e490-c042-4a45-ab13-bccadc84c941_1p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p
result, different session:
6ea78a58-0774-4928-ad83-403894d34862_1p,
b623e490-c042-4a45-ab13-bccadc84c941_1p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p,
14b79b00-6d79-4199-a149-b9e11b980e76_1p,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p
result, different session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p,
14b79b00-6d79-4199-a149-b9e11b980e76_1p,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_1p,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_1p,
95ca9047-9f51-4aa9-b92c-24d990ff274e_1p,
82511263-dcde-4054-875a-4f45afb136be_1p,
a743b6b9-da56-43c3-9dd7-29de73c67576_1p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p
result, different session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_1p,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_1p,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_1p,
2bd1c479-7336-43c9-b86e-406486807d13_1p,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_1p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
localStorage
The localStorage API gives websites access to a key-value database that will remain available across visits. If the localStorage API is not partitioned or blocked, it can also be used to track users across websites. |
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
2bbe5904-9b53-42c2-a9ec-37926527b6a2_1p,
64f65157-4029-4cca-a826-90689e865af8_1p,
3420a7ac-77f9-4a2d-916b-be77167b1cd7_1p,
99fd256d-4878-40ed-93ae-ee6150a82b84_1p,
ef6f996a-ad7d-48ba-be85-1035b0879537_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_1p,
b7de0a15-d667-44bd-b485-8711032ae50b_1p,
b1078821-b8a3-4434-8f5a-64d3136aebfe_1p,
19d71a06-b303-455f-971c-77cbf3e15b10_1p,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p
result, different session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_1p,
64fe2704-8adf-49ac-8923-03df5ab64bca_1p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_1p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_1p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
6ea78a58-0774-4928-ad83-403894d34862_1p,
b623e490-c042-4a45-ab13-bccadc84c941_1p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p
result, different session:
6ea78a58-0774-4928-ad83-403894d34862_1p,
b623e490-c042-4a45-ab13-bccadc84c941_1p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_1p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_1p,
64e9c8ba-9d43-4487-b797-06c0682bb337_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p,
14b79b00-6d79-4199-a149-b9e11b980e76_1p,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p
result, different session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_1p,
14b79b00-6d79-4199-a149-b9e11b980e76_1p,
c109ccae-27bb-445a-ba2e-b4b347005dab_1p,
b2d4efdd-ed26-40e0-a703-774607626ac2_1p,
8e293932-ee92-4938-8bf4-98ed034e24a2_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_1p,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_1p,
95ca9047-9f51-4aa9-b92c-24d990ff274e_1p,
82511263-dcde-4054-875a-4f45afb136be_1p,
a743b6b9-da56-43c3-9dd7-29de73c67576_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p
result, different session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_1p,
5e587c18-f655-4204-a29b-c126a9ba83a5_1p,
7d5061a3-5c01-46ab-86a7-705119ed3294_1p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_1p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_1p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_1p,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_1p,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_1p,
2bd1c479-7336-43c9-b86e-406486807d13_1p,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_1p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
prefetch cache
A <link rel='prefetch'...> suggests to browsers they should fetch a resource ahead of time and cache it. But if browsers don't partition this cache, it can be used to track users across websites. |
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
script cache
Caching of scripts in web browsers is a standard behavior. But if that cache leaks between websites, it can be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
XMLHttpRequest cache
Similar to the newer Fetch API, any resource received may be cached by the browser. The cache is potentially vulnerable to cross-site tracking attack. |
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
Cross-session third-party tracking testsWhich browsers prevent third-party trackers from tracking you across browser sessions?
A common vulnerability of web browsers is that they allow third-party trackers to 'tag' your browser with some tracking data. This tag can be used to re-identify you when you return to a website you visited before. This category of leaks can be prevented by browser if they clean or isolate data between browser sessions. (In cases where a user has logged into a website or entered detailed information, it may be justifiable for a browser to retain information across sessions. These tests check when no such justification exists: when you have entered no significant information into a website, will the browser still retain data that allows you to be tracked across sessions?) |
||||||||
|
Alt-Svc
Alt-Svc allows the server to indicate to the web browser that a resource should be loaded on a different server. Because this is a persistent setting, it could be used to track users across websites if it is not correctly partitioned. |
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async () => {
// Clear Alt-Svc caching first.
let responseText = '';
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/clear');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after clear:', responseText);
// Store "h3" state in Alt-Svc cache
for (let i = 0; i < 3; ++i) {
await fetch(altSvcOrigin + '/set');
await sleepMs(100);
}
responseText = await fetchText(altSvcOrigin + '/protocol');
console.log('after set:', responseText);
}
read: async () => {
const protocol = await fetchText(altSvcOrigin + '/protocol');
if ((new URL(window.location)).searchParams.get('thirdparty') === 'same') {
if (protocol !== 'h3') {
throw new Error('Unsupported');
}
}
return protocol;
}
result, same session: h2, h2, h2, h2, h2
result, different session: h2, h2, h2, h2, h2
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
CacheStorage
The Cache API is a content storage mechanism originally introduced to support ServiceWorkers. If the same Cache object is accessible to multiple websites, it can be abused to track users. |
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
64f65157-4029-4cca-a826-90689e865af8_3p,
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
result, different session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
64f65157-4029-4cca-a826-90689e865af8_3p,
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: true, false, true, true, true
passed: , false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p
result, different session:
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p,
61dcc06f-fcc3-4352-9325-e7a4cb1166b8_3p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p
result, different session:
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p,
ebf2de62-557c-4374-bd92-c6951d45a072_3p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p
result, different session:
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p,
e12b1bfd-d4e7-42ec-8987-f5706c86a3c1_3p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p
result, different session:
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p,
33cff721-4f19-4384-90f7-28875626f425_3p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
result, different session:
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url'),
Error: undefined is not an object (evaluating 'cacheKeys[0].url')
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p
result, different session:
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p,
04952854-3358-4881-9e6e-a019dbb2b47b_3p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
try {
const cache = await window.caches.open('supercookies');
cache.addAll([`test.css?key=${key}`]);
} catch (e) {
throw new Error('Unsupported');
}
}
read: async () => {
const cache = await window.caches.open('supercookies');
const cacheKeys = await cache.keys();
const url = cacheKeys[0].url;
return (new URL(url)).searchParams.get('key');
}
result, same session:
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p
result, different session:
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p,
dd027d1b-495e-4a45-ad74-c0fdaba86413_3p
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
cookie (HTTP)
The cookie, first introduced by Netscape in 1994, is a small amount of data stored by your browser on a website's behalf. It has legitimate uses, but it is also the classic cross-site tracking mechanism, and today still the most popular method of tracking users across websites. Browsers can stop cookies from being used for cross-site tracking by either blocking or partitioning them. |
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (secret) => {
// Request a page that will send an HTTPOnly 'set-cookie' response header with secret value.
await fetch(`${baseURI}cookie?secret=${secret}_http`);
}
read: async () => {
// Test if we now send a requests with a 'cookie' header containing the secret.
const response = await fetch(`${baseURI}headers`);
const cookie = (await response.json()).cookie;
return cookie ? cookie.match(/secret=([\w-]+)/)[1] : null;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
cookie (JS)
The cookie, first introduced by Netscape in 1994, is a small amount of data stored by your browser on a website's behalf. It has legitimate uses, but it is also the classic cross-site tracking mechanism, and today still the most popular method of tracking users across websites. Browsers can stop cookies from being used for cross-site tracking by either blocking or partitioning them. |
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (secret) => {
document.cookie = `secret=${secret}_js; max-age=3600; SameSite=None; Secure`;
}
read: () => document.cookie ? document.cookie.match(/secret=([\w-]+)/)[1] : null
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
CookieStore
The Cookie Store API is an alternative asynchronous API for managing cookies, supported by some browsers. |
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session:
Error: Type error,
Error: Type error,
Error: Type error,
Error: Type error,
Error: Type error
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (data) => {
const msPerHour = 60 * 60 * 1000;
if (!window.cookieStore) {
throw new Error('Unsupported');
}
window.cookieStore.set({
name: 'partition_test',
value: data,
expires: Date.now() + msPerHour,
sameSite: 'none'
});
}
read: async () => {
if (!window.cookieStore) {
throw new Error('Unsupported');
}
const cookie = await window.cookieStore.get('partition_test');
if (!cookie) {
return null;
}
return cookie.value;
}
result, same session: , , , ,
result, different session: , , , ,
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
CSS cache
CSS stylesheets are cached, and if that cache is shared between websites, it can be used to track users across sites. |
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_4129708173822484,
fake_4145511379321962,
fake_9065594372006562,
fake_5683879586159004,
fake_6813912962967474
result, different session:
fake_4129708173822484,
fake_4145511379321962,
fake_9065594372006562,
fake_5683879586159004,
fake_6813912962967474
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_31258448570010633,
fake_4622558936020491,
fake_9551538808839037,
fake_2862821442209149,
fake_5550692444568435
result, different session:
fake_31258448570010633,
fake_4622558936020491,
fake_9551538808839037,
fake_2862821442209149,
fake_5550692444568435
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_8791496647596828,
fake_9911383796966347,
fake_4825646001235513,
fake_4204226553081407,
fake_6371918556686176
result, different session:
fake_8791496647596828,
fake_9911383796966347,
fake_4825646001235513,
fake_4204226553081407,
fake_6371918556686176
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_7554668922872438,
fake_24282383175648214,
fake_35690048633748916,
fake_5516711199264246,
fake_5745106499107315
result, different session:
fake_7554668922872438,
fake_24282383175648214,
fake_35690048633748916,
fake_5516711199264246,
fake_5745106499107315
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_4147591301217588,
fake_20545836701899378,
fake_10781945379962599,
fake_6235107148913837,
fake_06615713782130395
result, different session:
fake_4147591301217588,
fake_20545836701899378,
fake_10781945379962599,
fake_6235107148913837,
fake_06615713782130395
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_5465226203792677,
fake_51805377935857,
fake_68226255952867,
fake_5596011203128008,
fake_017684142173356676
result, different session:
fake_7944010310528422,
fake_00413759769111377,
fake_7946319285793926,
fake_40036843728226956,
fake_16290876371162843
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_049223183934730796,
fake_7224530976774344,
fake_0950324082158478,
fake_09945025422647036,
fake_21884948184845876
result, different session:
fake_049223183934730796,
fake_7224530976774344,
fake_0950324082158478,
fake_09945025422647036,
fake_21884948184845876
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return key;
}
read: async (key) => {
const href = testURI('resource', 'css', key);
const head = document.getElementsByTagName('head')[0];
head.innerHTML += `<link type="text/css" rel="stylesheet" href="${href}">`;
const testElement = document.querySelector('#css');
let fontFamily;
while (true) {
await sleepMs(100);
fontFamily = window.getComputedStyle(testElement).fontFamily;
if (fontFamily.startsWith('fake')) {
break;
}
}
console.log(fontFamily);
return fontFamily;
}
result, same session:
fake_8991274638952624,
fake_5920721573846544,
fake_6305775055250731,
fake_07010764651651002,
fake_22352301121966534
result, different session:
fake_8991274638952624,
fake_5920721573846544,
fake_6305775055250731,
fake_07010764651651002,
fake_22352301121966534
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
favicon cache
A favicon is an icon that represents a website, typically shown in browser tab and bookmarks menu. If the favicon cache is not partitioned, it can be used to track users across websites. |
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => key
read: async (key) => {
// Wait for the favicon to load (defined in supercookies.html)
await sleepMs(2000);
const response = await fetch(
testURI('ctr', 'favicon', key), { cache: 'reload' });
const count = (await response.text()).trim();
if (count === '0') {
throw new Error('No requests received');
}
return count;
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
fetch cache
When a resource is received via the Fetch API, it is frequently cached. That cache can potentially be abused for cross-site tracking. |
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 2, 2, 2, 2, 2
result, different session: 3, 3, 3, 3, 3
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
return key;
}
read: async (key) => {
await fetch(testURI('resource', 'fetch', key),
{ cache: 'force-cache' });
const countResponse = await fetch(testURI('ctr', 'fetch', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
font cache
Web fonts are sometimes stored in their own cache, which is vulnerable to being abused for cross-site tracking. |
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } body { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
return key;
}
read: async (key) => {
const text = document.createElement('span');
text.id = 'text';
text.innerText = 'test';
document.body.appendChild(text);
const originalWidth = text.getBoundingClientRect().width;
const style = document.createElement('style');
style.type = 'text/css';
const fontURI = testURI('resource', 'font', key);
style.innerHTML = `@font-face {font-family: "myFont"; src: url("${fontURI}"); } #text { font-family: "myFont" }`;
document.getElementsByTagName('head')[0].appendChild(style);
let newWidth;
do {
await sleepMs(100);
newWidth = text.getBoundingClientRect().width;
} while (newWidth < 0 || newWidth === originalWidth);
const response = await fetch(
testURI('ctr', 'font', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
iframe cache
An iframe is an element in a web page than allows websites to embed a second web page. Caching of this web page could be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
iframe.addEventListener('load', () => resolve(key), { once: true });
iframe.src = testURI('resource', 'page', key);
})
read: async (key) => {
const iframe = document.createElement('iframe');
document.body.appendChild(iframe);
const iframeLoadPromise = new Promise((resolve, reject) => {
iframe.addEventListener('load', resolve, { once: true });
});
const address = testURI('resource', 'page', key);
iframe.src = address;
await iframeLoadPromise;
const response = await fetch(
testURI('ctr', 'page', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
image cache
Caching of images in web browsers is a standard behavior. But if that cache leaks between websites, it can be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const img = document.createElement('img');
document.body.appendChild(img);
img.addEventListener('load', () => resolve(key), { once: true });
img.src = testURI('resource', 'image', key);
})
read: async (key) => {
const img = document.createElement('img');
document.body.appendChild(img);
const imgLoadPromise = new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
});
img.src = testURI('resource', 'image', key);
await imgLoadPromise;
const response = await fetch(
testURI('ctr', 'image', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
indexedDB
The IndexedDB API exposes a transactional database to web pages. That database can be used to track users across websites, unless it is partitioned. |
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session: , 64f65157-4029-4cca-a826-90689e865af8_3p
result, different session: undefined
unsupported: true, false, true, true, true
passed: , true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_3p,
b7de0a15-d667-44bd-b485-8711032ae50b_3p,
b1078821-b8a3-4434-8f5a-64d3136aebfe_3p,
19d71a06-b303-455f-971c-77cbf3e15b10_3p,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_3p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_3p,
64fe2704-8adf-49ac-8923-03df5ab64bca_3p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_3p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_3p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_3p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
6ea78a58-0774-4928-ad83-403894d34862_3p,
b623e490-c042-4a45-ab13-bccadc84c941_3p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_3p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_3p,
64e9c8ba-9d43-4487-b797-06c0682bb337_3p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_3p,
14b79b00-6d79-4199-a149-b9e11b980e76_3p,
c109ccae-27bb-445a-ba2e-b4b347005dab_3p,
b2d4efdd-ed26-40e0-a703-774607626ac2_3p,
8e293932-ee92-4938-8bf4-98ed034e24a2_3p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_3p,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_3p,
95ca9047-9f51-4aa9-b92c-24d990ff274e_3p,
82511263-dcde-4054-875a-4f45afb136be_3p,
a743b6b9-da56-43c3-9dd7-29de73c67576_3p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_3p,
5e587c18-f655-4204-a29b-c126a9ba83a5_3p,
7d5061a3-5c01-46ab-86a7-705119ed3294_3p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_3p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_3p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (secret) => {
try {
return await IdbKeyVal.set('secret', secret);
} catch (e) {
throw new Error('Unsupported');
}
}
read: () => IdbKeyVal.get('secret')
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_3p,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_3p,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_3p,
2bd1c479-7336-43c9-b86e-406486807d13_3p,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_3p
result, different session: undefined
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
localStorage
The localStorage API gives websites access to a key-value database that will remain available across visits. If the localStorage API is not partitioned or blocked, it can also be used to track users across websites. |
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session: , 64f65157-4029-4cca-a826-90689e865af8_3p, , ,
result, different session: , , , ,
unsupported: true, false, true, true, true
passed: , true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
efab9cc2-8119-4324-a177-b86f7091dd99_3p,
b7de0a15-d667-44bd-b485-8711032ae50b_3p,
b1078821-b8a3-4434-8f5a-64d3136aebfe_3p,
19d71a06-b303-455f-971c-77cbf3e15b10_3p,
7050dfb8-26a5-4b10-8a5f-d6638272b77e_3p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
98629a13-db8e-4bf8-9c50-dff4d8f74e53_3p,
64fe2704-8adf-49ac-8923-03df5ab64bca_3p,
a0f22366-2c4d-4d06-a06d-a5e4bf219de3_3p,
0813080a-3a11-4d62-8333-01dfe7fbed0f_3p,
e5b1d55e-9c26-4fd8-83c7-5ffa1e6cfef9_3p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
6ea78a58-0774-4928-ad83-403894d34862_3p,
b623e490-c042-4a45-ab13-bccadc84c941_3p,
c69d25b6-99e1-4de1-9560-73e614c6ec4d_3p,
2a430bed-9590-4cdf-b54c-7c75036daf4c_3p,
64e9c8ba-9d43-4487-b797-06c0682bb337_3p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
0fbc05bc-5d40-448a-8a42-2a2b789cc908_3p,
14b79b00-6d79-4199-a149-b9e11b980e76_3p,
c109ccae-27bb-445a-ba2e-b4b347005dab_3p,
b2d4efdd-ed26-40e0-a703-774607626ac2_3p,
8e293932-ee92-4938-8bf4-98ed034e24a2_3p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
f94a6cdf-6a70-46f5-8102-8281c0fd4656_3p,
a73731aa-d0e5-40fe-969b-c50b5095c0cd_3p,
95ca9047-9f51-4aa9-b92c-24d990ff274e_3p,
82511263-dcde-4054-875a-4f45afb136be_3p,
a743b6b9-da56-43c3-9dd7-29de73c67576_3p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
39f1b1ff-adc0-4bf7-ae37-63aa9be978ff_3p,
5e587c18-f655-4204-a29b-c126a9ba83a5_3p,
7d5061a3-5c01-46ab-86a7-705119ed3294_3p,
c44c02c8-b0ac-4a7e-9292-ad1d15669220_3p,
c0d8f011-fb3f-43ba-b8b2-a02ddc13094f_3p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (secret) => { window.localStorage.setItem('secret', secret); }
read: () => window.localStorage.getItem('secret')
result, same session:
e81b4cbb-6161-4f61-8e06-41396b557c7e_3p,
936251c8-f2a6-49a7-9968-b62c87c4dbe6_3p,
7ecb0b5e-06ac-4f0b-9877-13941aafa595_3p,
2bd1c479-7336-43c9-b86e-406486807d13_3p,
08a71f8d-bda4-42f9-8d2c-8d106710d9aa_3p
result, different session: , , , ,
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
|
prefetch cache
A <link rel='prefetch'...> suggests to browsers they should fetch a resource ahead of time and cache it. But if browsers don't partition this cache, it can be used to track users across websites. |
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
write: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
return key;
}
read: async (key) => {
const link = document.createElement('link');
link.rel = 'prefetch';
link.href = testURI('resource', 'prefetch', key);
document.getElementsByTagName('head')[0].appendChild(link);
await sleepMs(500);
const response = await fetch(
testURI('ctr', 'prefetch', key), { cache: 'reload' });
const countString = (await response.text()).trim();
if (parseInt(countString) === 0) {
throw new Error('No requests received');
}
return countString;
}
result, same session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
result, different session:
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received,
Error: No requests received
unsupported: true, true, true, true, true
passed: undefined
test failed: false, false, false, false, false
|
|
script cache
Caching of scripts in web browsers is a standard behavior. But if that cache leaks between websites, it can be abused for cross-site tracking. |
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: (key) => new Promise((resolve, reject) => {
const script = document.createElement('script');
document.body.appendChild(script);
script.addEventListener('load', () => resolve(key), { once: true });
script.src = testURI('resource', 'script', key);
})
read: async (key) => {
const script = document.createElement('script');
document.body.appendChild(script);
const scriptLoadPromise = new Promise((resolve, reject) => {
script.addEventListener('load', resolve, { once: true });
});
script.src = testURI('resource', 'script', key);
await scriptLoadPromise;
const response = await fetch(
testURI('ctr', 'script', key), { cache: 'reload' });
return (await response.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
|
XMLHttpRequest cache
Similar to the newer Fetch API, any resource received may be cached by the browser. The cache is potentially vulnerable to cross-site tracking attack. |
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 2, 2, 2, 2, 2
unsupported: false, false, false, false, false
passed: true, true, true, true, true
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|
write: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
return key;
}
read: async (key) => {
const req = new window.XMLHttpRequest();
const loadPromise = new Promise(resolve => req.addEventListener('load', resolve));
req.open('GET', testURI('resource', 'xhr', key));
req.send();
await loadPromise;
const countResponse = await fetch(testURI('ctr', 'xhr', key),
{ cache: 'reload' });
return (await countResponse.text()).trim();
}
result, same session: 1, 1, 1, 1, 1
result, different session: 1, 1, 1, 1, 1
unsupported: false, false, false, false, false
passed: false, false, false, false, false
test failed: false, false, false, false, false
|