Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update automatic beacon explainer for new sending behavior #808

Merged
merged 7 commits into from
Nov 8, 2023
Merged

Update automatic beacon explainer for new sending behavior #808

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
97e8f56
update automatic beacon explainer
blu25 Sep 14, 2023
dedbe93
update section on component ads
blu25 Sep 26, 2023
c0d0ad4
update to include changes from security review
blu25 Oct 9, 2023
5f68360
fix formatting
blu25 Oct 9, 2023
d28afbe
update to include changes from code review
blu25 Oct 10, 2023
8bf8260
address review comments
blu25 Oct 23, 2023
ee968ab
fix typo
blu25 Oct 26, 2023
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
address review comments
  • Loading branch information
@blu25
blu25 committed Oct 23, 2023
commit 8bf8260b9625740158b3c889fa20db1e0d5388d2
6 changes: 3 additions & 3 deletions Fenced_Frames_Ads_Reporting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ From a privacy perspective, it is also important to note that the additional inf

# Design

The following summarizes the sequence of events for the buyer and seller. Distinguishing these flows here, since in principle, one should be able to report without the help of the other.
The following summarizes the sequence of events for the buyer and seller. Distinguishing these flows here, since in principle, one should be able to report without the help of the other but with an opt-in from the ad's origin for mainitaining web's security principles for origins.
blu25 marked this conversation as resolved.
Show resolved Hide resolved

![high level diagram](assets/fenced_frames_reporting.png)

Expand Down Expand Up @@ -167,7 +167,7 @@ window.fence.setReportEventDataForAutomaticBeacons({
});
```

If `setReportEventDataForAutomaticBeacons` is invoked, the browser will send an automatic beacon to all registered URLs, but will only send an event data body (the information in `eventData`) with the HTTP request to destinations specified in the `destination` field.
If `setReportEventDataForAutomaticBeacons` is invoked, the browser will send an automatic beacon to all URLs registered via registerAdBeacon for the given event, but it will only send an event data body (the information in eventData) with the HTTP request to destinations specified in the destination field. This means that invoking setReportEventDataForAutomaticBeacons acts as an opt-in by the fenced frame document to allow sending the beacon to all registered URLs, aligning with cross-origin security principles.

If `setReportEventDataForAutomaticBeacons` is not invoked, the browser will not send an automatic beacon to any registered URLs.

Expand Down Expand Up @@ -227,7 +227,7 @@ For fenced frames rendering the ad components under the top-level ad fenced fram
* Invocation of the `reportEvent` API from an ad component fenced frame is disallowed.
* The only supported beacon to be sent from an ad component fenced frame is the `reserved.top_navigation` automatic beacon. Note this beacon is gated on a user activation (e.g. click).
* To ensure that there is no arbitrary data that can be received at the server from the component ad, the `eventData` field via `window.fence.setReportEventDataForAutomaticBeacons`, if specified, will be ignored. This ensures that information from the component ad URL is not revealed in the event report, or else it could lead to the join of two independently k-anonymous URLs (parent and component ad) at the receiving server.
* `reserved.top_navigation` beacons will be sent from a component fenced frame (with no event data) when there is a user activation (e.g. click) on the ad component fenced frame, which results in a top-level navigation. Invoking `setReportEventDataForAutomaticBeacons` from a component fenced frame will have no effect.
* `reserved.top_navigation` beacons will be sent from a component fenced frame (with no event data) when there is a user activation (e.g. click) on the ad component fenced frame, which results in a top-level navigation. The ad component must still opt in using `setReportEventDataForAutomaticBeacons` before the beacon can send.

```
window.fence.setReportEventDataForAutomaticBeacons({
Expand Down