Load this page from its .onion URL.

Sub-resources

Test this first since the navigation tests will cause these sub-resources to be loaded from cache.

Same-origin

Check the Request Headers in the Network tab of the devtools to ensure that:

• was loaded with the full Referer header and the origin of this page in the Origin header.
• was loaded with a full Referer header and without an Origin header.
• was loaded with a full Referer header and the origin of this page in the Origin header.
• 
  was loaded with a full Referer header and without an Origin header.
• 
  was loaded with a full Referer header and without an Origin header.

Cross-origin

Check the Request Headers in the Network tab of the devtools to ensure that:

• was loaded without a Referer header and with a value of null in the Origin header.
• was loaded without Referer or Origin headers.
• was loaded without a Referer header and a value of null in the Origin header.
• 
  was loaded without Referer or Origin headers.
• 
  (skip devtools check for this iframe)

Navigations

You'll have to use the Back button to come back to this page after each test.

For referrer tests, look at the JS referrer displayed on the page, as well as the request header in the devtools.

Because of caching issues, if you want to repeat any of these tests, it's best to close the browser and restart it first.

Same-origin

The Referer header should be present (full URL of this page) in this example:

• Check referrer after a same-origin GET navigation.
• Check referrer after a same-origin GET navigation ending up in a redirect.

The Referer and Origin headers should be present (full URL, and same hostname as this page, respectively) in all of these examples:

• after a same-origin POST navigation.
• after a POST navigation ending up in a redirect.

Cross-origin

Neither the Referer not the Origin header should be present in these examples:

• Check referrer after a cross-origin GET navigation.
• Check referrer after a same-origin GET navigation ending up in a cross-origin redirect.
• Check referrer after a cross-origin GET navigation ending up in a same-origin redirect.

The Referer header should not be present and the Origin header should be null in all of these examples:

• after a cross-origin POST navigation.
• after a same-origin POST navigation ending up in a cross-origin redirect.
• after a cross-origin POST navigation ending up in a same-origin redirect.