← Back to home

Image-based pixel

Two installs side-by-side. Variant A sends only the token. Variant B uses a different (longer) token and carries the page URL via a u= parameter. No script execution is involved; the browser issues the GET as soon as the parser encounters the tag, so there is no race condition.

Variant A · token only

Minimal install. The server receives the hit but has no URL context for it.

Verdict
Waiting for the image to load…
<img> onload
—
<img> onerror
—
Network req.
—
1×1 pixel rendered here
Event timeline
  1. No events recorded yet…
Install code
<img src="https://staging-api.wire.spbx.app/wire/img?token=KUNDX3kr75Sa2ny%2BLGS8I87Hxv9Hs9cU6ZgCG6iJsKE%3D"
     width="1" height="1" alt="" />
Variant B · token + u parameter

Full install. Uses a different (longer) token and carries the page URL via u=https://test-wire.spbx.app.

Verdict
Waiting for the image to load…
<img> onload
—
<img> onerror
—
Network req.
—
1×1 pixel rendered here
Event timeline
  1. No events recorded yet…
Install code
<img src="https://staging-api.wire.spbx.app/wire/img?token=KUNDX3kr75Sa2ny%2BLGS8IwBg8MYVS1dae96YhJBtdUlWn6xb9zUImlHLAew5pHLP4JAM4bDOjQVoM1J9%2BeRbWQ%3D%3D&u=https%3A%2F%2Ftest-wire.spbx.app"
     width="1" height="1" alt="" />