Some browser features open a native screen when the user enters a specific URL in the address bar. When that should only happen for URLs the user typed or pasted themselves, a web page must not be able to trigger the same screen by navigating to that URL.
This page navigates to a target URL in every way a web page can. For each case, the browser should load the URL as a normal web page (or block it) and should not open the native screen.
You can also link to this page with ?url=https://…. Only DuckDuckGo domains are accepted.
target="_blank"target="_blank" rel="noopener noreferrer"download attributeAlso try long-pressing / right-clicking these and choosing "Open in new tab".
Reload this page, then set location.href = url after 6s with no user gesture
The automatic case starts from a fresh page load and waits longer than any browser's user-activation window (5s in Chromium), so the navigation has no user gesture. Don't tap the page while it counts down.
Each link opens an intermediate page that redirects to url. The server-side case covers a browser that matches the URL after a redirect instead of matching what the user entered.
A GET form always replaces the URL's query with its fields, so this navigates to
. Type that URL in section 6 to check it still counts as a typed match;
otherwise this case passes for the wrong reason.
These are links, so none of them should open the native screen. Also type each one into the address bar to check which variants the typed-URL match accepts. Decide the expected result for each variant in the spec.
Expected behavior for these depends on the feature's spec.