tree b3d5f4625fda564a8ad2e51248ba1fc59f21a3d0
parent e720d4d2a2ea9f9c1610841adb628e478495ff8d
author Liam Brady <lbrady@google.com> 1712177477 -0700
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1712187462 -0700

Cross-origin support for window.fence.reportEvent().

Third-party ad serving (3PAS) lets advertisers manage ads across
different bidding platforms. However, the event-level reporting API
(reportEvent()) currently prevents direct reporting from documents that
are cross-origin to the root ad frame's fenced frame config's mapped
URL, limiting this functionality for the 3PAS use case. This CL extends
the reportEvent() API to support this use case.

To allow cross-origin reporting while still preserving privacy, both the
ad frame and the 3PAS subframe must explicitly opt in. The ad frame opts
in using a new `Allow-Cross-Origin-Event-Reporting` response header,
while the 3PAS subframe opts in by calling reportEvent() with
`crossOriginExposed=true`. If both opt-ins are present, then the
reportEvent() call from the 3PAS document will succeed.

This CL adds histograms to track how many beacons are sent from
documents that are same-origin and cross-origin to the fenced frame
config's mapped url.

This CL also expands the fenced frame WPT system to support
content-initiated navigations of fenced frame contexts to cross-origin
URLs.

Change-Id: I4e895bec4cb77604e2017cfc67b496d59863a30b
Bug: 331844131
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5403108
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Ben Kelly <wanderview@chromium.org>
Reviewed-by: Dominic Farolino <dom@chromium.org>
Reviewed-by: Garrett Tanzer <gtanzer@chromium.org>
Commit-Queue: Liam Brady <lbrady@google.com>
Cr-Commit-Position: refs/heads/main@{#1282086}