I use a simple colab notebook which uses an iframe of to display a simple webpage. Unfortunately I get different results based on the browser.

Both browsers have similar
privacy.firstparty.isolate
network.cookie.cookieBehavior
(So these are not the issue)

On Mullvad browser, (a similar browser to the Tor Browser just without the tor network) I get a 403 Forbidden With these headers:

Mullvad Browser Request Header:
GET / HTTP/2
Host: gwrwxvvrmxa-496ff2e9c6d22116-8188-colab.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
TE: trailers

Mullvad Browser Response Header:
HTTP/2 403 Forbidden
cache-control: private
content-length: 1449
content-type: text/html; charset=utf-8
date: Sat, 01 Jun 2024 19:50:04 GMT
referrer-policy: no-referrer
server: TornadoServer/4.5.3
x-content-type-options: nosniff
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

(Sidenote: I don't think the issue is with HTTP/2 because just before this request we GET 200 OK from the same exact host

GET /outputframe.html?vrz=colab_20240530-060148_RC00_638597350 HTTP/2
Host: 7xph8z84kgg-496ff2e9c6d22116-8188-colab.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://colab.research.google.com/
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
accept-ranges: bytes
cache-control: max-age=86400
content-encoding: gzip
content-type: text/html
date: Sat, 01 Jun 2024 20:24:24 GMT
etag: "4894b61b747cc750a590e4e0892ba4f1"
referrer-policy: no-referrer
server: TornadoServer/4.5.3
x-content-type-options: nosniff
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2)

MB's console:

Feature Policy: Skipping unsupported feature name “xr-spatial-tracking”. outputframe.html:25:12
GET
https://m08doa3a30m-496ff2e9c6d22116-8188-colab.googleusercontent.com/
[HTTP/2 403 Forbidden 408ms]


---

Yet, it succeeds with Librewolf (a slightly different version of Firefox) with these request headers:

Librewolf
GET / HTTP/1.1
Host: lhjrmjf7za-496ff2e9c6d22116-8188-colab.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site


Librewolf Response Headers
HTTP/1.1 200 
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: text/html
date: Sat, 01 Jun 2024 19:50:01 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
last-modified: Sat, 01 Jun 2024 19:49:36 GMT
pragma: no-cache
server: SimpleHTTP/0.6 Python/3.10.12
x-content-type-options: nosniff
x-firefox-spdy: h2
x-xss-protection: 0

Librewolf's Console doesn't get a 403:

Feature Policy: Skipping unsupported feature name “xr-spatial-tracking”. outputframe.html:25:12
This page is in Quirks Mode. Page layout may be impacted. For Standards Mode use “<!DOCTYPE html>”.
o9hm0tgvvj-496ff2e9c6d22116-8188-colab.googleusercontent.com
Partitioned cookie or storage access was provided to “https://o9hm0tgvvj-496ff2e9c6d22116-8188-colab.googleusercontent.com/” because it is loaded in the third-party context and dynamic state partitioning is enabled.

XHRPUT
[HTTP/2 412  953ms]

---

Think step-by-step on how to provide a non-trivial solution. Concretely speaking, what should I do? And How?