Image-based pixel
Two installs side-by-side. Variant A sends only the token. Variant B uses a different (longer) token and carries the page URL via a u= parameter. No script execution is involved; the browser issues the GET as soon as the parser encounters the tag, so there is no race condition.
Variant A · token only
Minimal install. The server receives the hit but has no URL context for it.
Verdict
Waiting for the image to load…
<img> onload
—
<img> onerror
—
Network req.
—
Event timeline
- No events recorded yet…
Install code
<img src="https://staging-api.wire.spbx.app/wire/img?token=KUNDX3kr75Sa2ny%2BLGS8I87Hxv9Hs9cU6ZgCG6iJsKE%3D"
width="1" height="1" alt="" />Variant B · token + u parameter
Full install. Uses a different (longer) token and carries the page URL via u=https://test-wire.spbx.app.
Verdict
Waiting for the image to load…
<img> onload
—
<img> onerror
—
Network req.
—
Event timeline
- No events recorded yet…
Install code
<img src="https://staging-api.wire.spbx.app/wire/img?token=KUNDX3kr75Sa2ny%2BLGS8IwBg8MYVS1dae96YhJBtdUlWn6xb9zUImlHLAew5pHLP4JAM4bDOjQVoM1J9%2BeRbWQ%3D%3D&u=https%3A%2F%2Ftest-wire.spbx.app"
width="1" height="1" alt="" />