TLS on top of that ignore:

CORS

img tag GET request cookie sanitation on modern browsers

3rd party cookie filter/discard

All kind of other privacy filtering

It's just like TLS SNI a very obvious feature completely contrary to TLS privacy purpose, but which very few people know about.