Intent to Ship: Attribution Reporting Feature: Remove ar_debug Requirement

157 views
Skip to first unread message

Akash Nadan

unread,
Nov 5, 2024, 3:30:42 PMNov 5
to blink-dev
Contact emails

akash...@google.com, lin...@chromium.org, john...@chromium.org


Explainer

Attribution Reporting with event-level reports

Attribution Reporting API with Aggregatable Reports

Aggregation Service for the Attribution Reporting API


Specification

https://wicg.github.io/attribution-reporting-api/


Blink component

Internals > AttributionReporting


TAG review

Still under review under the original I2S for the Attribution Reporting API


TAG review status

Pending


Summary

We are landing the following change to the Attribution Reporting API focused on:

  • making it easier to receive API cookie-based debug reports


Currently the API allows cookie-based debug reporting only if third-party cookies are available AND the API caller sets the special unpartitioned ar_debug cookie.


This change makes it easier for API callers to use the API’s cookie-based debug reporting by allowing them to receive cookie-based debug reports as long as they have third-party cookie accessibility on the source/destination sites, and they no longer need to actually set the ar_debug cookie. Third-party cookie accessibility is equivalent to the API caller’s ability to set the ar_debug cookie.


This change makes it easier for API callers to receive cookie-based API debug reports (i.e. lower chance of misconfigured ar_debug cookies).


Explainer/Spec changes
  1. Explainer & Spec: https://github.com/WICG/attribution-reporting-api/issues/1440


Risks
Interoperability and Compatibility

This is not a fully backwards compatible change. The API caller may receive more debug reports overall, however this is unlikely because the  API caller can only set the unpartitioned cookie if they have third-party cookie access and they still have control over whether to enable cookie-based debug reporting via setting other API fields. Additionally, this change will not break any pre-existing API integrations or web functionality.


Gecko: No signal (Original request: https://github.com/mozilla/standards-positions/issues/791)


WebKit: No signal (Original request: https://github.com/WebKit/standards-positions/issues/180)



WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

No


              

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

The attribution reporting feature will be supported on all platforms with the exception of Android WebView


Is this feature fully tested by web-platform-tests?

Yes


Estimated milestones

This feature is anticipated to ship as part of Chrome 132


Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5107034180288512


Links to previous Intent discussions

Previous I2S: 

Intent to Ship: Attribution Reporting API

Intent to Ship: Attribution Reporting features M117

Intent to Ship: Attribution Reporting features M118

Intent to Ship: Attribution Reporting features M119

Intent to Ship: Attribution Reporting features M120

Intent to Ship: Attribution Reporting features M121

Intent to Ship: Attribution Reporting features M123

Intent to Ship: Attribution Reporting features M124

Intent to Ship: Attribution Reporting features M125

Intent to Ship: Attribution Reporting features M126

Intent to Ship: Attribution Reporting features M127

Intent to Ship: Attribution Reporting features M128 (1)

Intent to Ship: Attribution Reporting features M128 (2)

Intent to Ship: Attribution Reporting feature M130


Mike Taylor

unread,
Nov 5, 2024, 4:36:56 PMNov 5
to Akash Nadan, blink-dev

On 11/5/24 3:30 PM, 'Akash Nadan' via blink-dev wrote:

Contact emails

akash...@google.com, lin...@chromium.org, john...@chromium.org


Explainer

Attribution Reporting with event-level reports

Attribution Reporting API with Aggregatable Reports

Aggregation Service for the Attribution Reporting API


Specification

https://wicg.github.io/attribution-reporting-api/


Blink component

Internals > AttributionReporting


TAG review

Still under review under the original I2S for the Attribution Reporting API


TAG review status

Pending


Summary

We are landing the following change to the Attribution Reporting API focused on:

  • making it easier to receive API cookie-based debug reports


Currently the API allows cookie-based debug reporting only if third-party cookies are available AND the API caller sets the special unpartitioned ar_debug cookie.


This change makes it easier for API callers to use the API’s cookie-based debug reporting by allowing them to receive cookie-based debug reports as long as they have third-party cookie accessibility on the source/destination sites, and they no longer need to actually set the ar_debug cookie. Third-party cookie accessibility is equivalent to the API caller’s ability to set the ar_debug cookie.


This change makes it easier for API callers to receive cookie-based API debug reports (i.e. lower chance of misconfigured ar_debug cookies).


Explainer/Spec changes
  1. Explainer & Spec: https://github.com/WICG/attribution-reporting-api/issues/1440

Can you motivate this change a little more? I'm not seeing developer feedback in this issue that requiring the ar_debug cookie is a burden - so why do we want to make this change now?
--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/dabe5dbd-7c60-4f4f-b355-4f082bb9e62an%40chromium.org.

Nan Lin

unread,
Nov 5, 2024, 5:11:27 PMNov 5
to Mike Taylor, Akash Nadan, blink-dev
Hi Mike,

Thanks for the quick response. Please see the inline response.

Thanks,
Nan

In the past, we've heard about feedback on missing debug reports due to misconfigured ar_debug cookie (e.g.  https://github.com/WICG/attribution-reporting-api/issues/1195).
Therefore, our motivation is to improve utility, and in the meanwhile bring Attribution Reporting API in alignment with Private Aggregation API in terms of debugging behavior.

Mike Taylor

unread,
Nov 6, 2024, 9:25:08 AMNov 6
to Nan Lin, Akash Nadan, blink-dev

Thanks - looking at https://github.com/WICG/attribution-reporting-api/issues/1195#issuecomment-2018709555 it seems like the developer just misconfigured the debug cookie, right?

So I guess my question is: why did we think requiring this cookie was a good idea in the past, and why do we not believe that now? I agree it is awkward that ARA and PAA don't have similar debug requirements.

Nan Lin

unread,
Nov 6, 2024, 1:28:42 PMNov 6
to Mike Taylor, Akash Nadan, blink-dev
Hi Mike,

Thanks. Please see the inline response.

Nan

Yes, the developer misconfigured the debug cookie and therefore didn't get debug reporting to work. We've also heard similar feedback on misconfigured debug cookies.

The purpose of the ar_debug cookie requirement was to make it very clear that cookie-based debug reporting is tied to whether the reporting origin has access to unpartitioned cookies, but it's not really improving privacy.
Removing the requirement would allow us to bring ARA in alignment with PAA, and also make it easier for reporting origins to set up cookie-based debug reporting while not regressing privacy.
Therefore, we think it's fine to remove the requirement for those reasons and base debug reporting on whether reporting origins have the capability to access third-party cookies.

Mike Taylor

unread,
Nov 6, 2024, 3:25:41 PMNov 6
to Nan Lin, Akash Nadan, blink-dev

OK - thanks for the responses. One more question: if sites continue to send the ar_debug cookie, will they still get the expected debug reporting? Or will they need to stop sending it?

Akash Nadan

unread,
Nov 6, 2024, 5:48:54 PMNov 6
to blink-dev, Mike Taylor, Akash Nadan, blink-dev, Nan Lin
Hi Mike,

If a site continues to set the ar_debug cookie, they will still be able to get the expected debug reporting. They do not need to stop setting it.

Thanks,
Akash

Mike Taylor

unread,
Nov 7, 2024, 9:51:20 AMNov 7
to Akash Nadan, blink-dev, Nan Lin

OK - thank you.

LGTM1

Akash Nadan

unread,
Nov 7, 2024, 4:42:00 PMNov 7
to blink-dev, Mike Taylor, Nan Lin, Akash Nadan
Hi All,

Slight update to one of the I2S questions:

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?
The attribution reporting feature will be supported on all platforms.

Thanks,
Akash

Mike Taylor

unread,
Nov 7, 2024, 5:18:33 PMNov 7
to Akash Nadan, blink-dev, Nan Lin

Thank you - can you please update the chromestatus entry "Supported on all platforms?" entry?

Akash Nadan

unread,
Nov 7, 2024, 5:21:00 PMNov 7
to blink-dev, Mike Taylor, Nan Lin, Akash Nadan
Hi Mike,

I have updated the chromestatus entry to reflect this.

Thanks,
Akash

Vladimir Levin

unread,
Nov 13, 2024, 11:24:21 AMNov 13
to Akash Nadan, blink-dev, Mike Taylor, Nan Lin

Chris Harrelson

unread,
Nov 13, 2024, 11:24:51 AMNov 13
to Vladimir Levin, Akash Nadan, blink-dev, Mike Taylor, Nan Lin
Reply all
Reply to author
Forward
0 new messages