Request for feedback: user activation design in Attribution

[martinthomson]

What is the issue with the HTML Standard?

Hi!

The PATWG is in the process of gathering feedback on the Attribution API.

There is a lot relevant to HTML in the specification, but that's true of virtually any web API. The specific part where HTML spec expertise might be most useful is the design we have around user activation. We have slightly different requirements for activation than exist for transient activation, which led to an approach that we think meets our needs, but it is quite a bit different from the existing activation flows.

Note that this is part of the abuse mitigations needed by the privacy analysis. We might not need exactly this design, but this is our best attempt so far.

Activation for attribution is the section of the specification that addresses this point.

Any feedback you have would be welcome. Including on other aspects of the API design. Feel free to reply to this issue or open issues on our specification repository. Thanks!

[zcorpan]

These bullet points could maybe be merged, if I understand the intent correctly:

• Additionally, when navigation is initiated by a user (that is, where the user navigation involvement is "browser UI"), the Attribution API is available for a short period.

• Any navigation of the top-level traversable to a different site disables the API. However, any activation, which might include the action that initiated the navigation, could make the API available again.

i.e. check that the navigation is not a cross-site top-level navigation before making the API available.

[martinthomson]

The first establishes one of the two conditions for activation: a click or user-initiated navigation. I'm trying to avoid a state machine diagram, but it should be something like:

null --a--> available --b--> enabled --c--> null

Where -a- is a click or navigation, -b- is using the API (within the time limit), and -c- is cross-site navigation.

I've taken another go at explaining this with those three states as the three bullets. Is that clearer?

[zcorpan]

I had missed the distinction between available and enabled. w3c/attribution#434 is clearer.

[smaug----]

I'm not quite sure I understand the current definition
"When the API is successfully used, the API is enabled for use by all descendant navigables of the top-level traversable’s active document (that is, all frames on the current page) can access the API without further availability checks."

"Each activation makes the API available to at most one site."

So if top level page has cross-site iframes, what is the expected behavior in those iframes?
But perhaps I get confused with "available" and "enabled" here?

[martinthomson]

At a risk of adding more imprecision to the explanation, I've added some clarifications to w3c/attribution#446

@smaug----, does that address your concern?

[smaug----]

I think that helps, thanks.
(Not sure top-level site is defined anywhere, so maybe there there is some more precise way to define that.)

[martinthomson]

The "top-level site" thing is a bit loose. You might reasonably say I'm going with this being OK on the basis that it is explanatory text, not the definition. (We could say that this is the site of origin of the top-level browsing context or something like that, but it's a mouthfull.)