Request for feedback: user activation design in Attribution

[martinthomson]

What is the issue with the HTML Standard?

Hi!

The PATWG is in the process of gathering feedback on the Attribution API.

There is a lot relevant to HTML in the specification, but that's true of virtually any web API. The specific part where HTML spec expertise might be most useful is the design we have around user activation. We have slightly different requirements for activation than exist for transient activation, which led to an approach that we think meets our needs, but it is quite a bit different from the existing activation flows.

Note that this is part of the abuse mitigations needed by the privacy analysis. We might not need exactly this design, but this is our best attempt so far.

Activation for attribution is the section of the specification that addresses this point.

Any feedback you have would be welcome. Including on other aspects of the API design. Feel free to reply to this issue or open issues on our specification repository. Thanks!

[zcorpan]

These bullet points could maybe be merged, if I understand the intent correctly:

• Additionally, when navigation is initiated by a user (that is, where the user navigation involvement is "browser UI"), the Attribution API is available for a short period.

• Any navigation of the top-level traversable to a different site disables the API. However, any activation, which might include the action that initiated the navigation, could make the API available again.

i.e. check that the navigation is not a cross-site top-level navigation before making the API available.

[martinthomson]

The first establishes one of the two conditions for activation: a click or user-initiated navigation. I'm trying to avoid a state machine diagram, but it should be something like:

null --a--> available --b--> enabled --c--> null

Where -a- is a click or navigation, -b- is using the API (within the time limit), and -c- is cross-site navigation.

I've taken another go at explaining this with those three states as the three bullets. Is that clearer?

[zcorpan]

I had missed the distinction between available and enabled. w3c/attribution#434 is clearer.