Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update automatic beacon explainer for new sending behavior #808

Merged
merged 7 commits into from
Nov 8, 2023

Conversation

blu25
Copy link
Contributor

@blu25 blu25 commented Sep 14, 2023

Automatic beacons will now send to all URLs that registered with the reserved.top_navigation event type, regardless of what data was set when calling setReportEventDataForAutomaticBeacons(). However, automatic beacon data will only be included in the beacon if the beacon's destination is specified in the destination field when calling setReportEventDataForAutomaticBeacons().

@maciejkowalczyk
Copy link

Will this change also affect ad component fenced frames?
They would no longer need to call setReportEventDataForAutomaticBeacons as their beacons were already not allowed to send any data.

@blu25
Copy link
Contributor Author

blu25 commented Sep 26, 2023

Will this change also affect ad component fenced frames?

Yes. This will change the behavior of all automatic beacons, regardless of the frame they originate from.

They would no longer need to call setReportEventDataForAutomaticBeacons as their beacons were already not allowed to send any data.

Correct. Now, any registered destinations will get automatic beacons without the component ad needing to do anything.

@JensenPaul
Copy link
Collaborator

@shivanigithub, would you like to review this PR?

@blu25
Copy link
Contributor Author

blu25 commented Oct 9, 2023

@maciejkowalczyk There's an update on this feature. We got pushback during a security review and need to modify how this feature behaves. Frames will still need to call setReportEventDataForAutomaticBeacons() so that they have an opportunity to opt in to information being sent to a potentially remote origin (without the opt-in, this could potentially create a cross-origin information leak if the frame doesn't want the information being sent out). However, they won't need to specify destinations in the destination field for them to receive the beacon; that will still only control whether eventData is included in the beacon, and every registered destination will get a beacon after setReportEventDataForAutomaticBeacons() is called at least once.

What this means for ad components is that they will still need to call setReportEventDataForAutomaticBeacons() at least once to opt in, but they only need to specify the eventType and can leave the destination field as [].

Copy link
Contributor

@shivanigithub shivanigithub left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@JensenPaul JensenPaul merged commit 22e7c5b into WICG:main Nov 8, 2023
2 checks passed
github-actions bot added a commit that referenced this pull request Nov 8, 2023
SHA: 22e7c5b
Reason: push, by JensenPaul

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants