WICG / WICG/webpackage

Is it OK to let the publishers know the SXG distributor's URL?

Open
#433 13 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

architecture feature request Pending Security + Privacy Review
Dominant language
Go
Stars
1.3k
Forks
125
PR merge metrics
No merged PRs in 30d

Description

I have stopped working on Signed Exchange Reporting for publishers. https://github.com/w3c/network-error-logging/issues/99#issuecomment-490739647
This is mainly because it is not clear whether is it OK to let the publisher know the distributor's URL.

If my understanding is correct, we can't know redirecting URLs.
The publisher can only know "aggregator.example/feed" using referrer in this case:

  • aggregator.example/feed -> redirect.example/publisher.example/article (returns 301 redirect) -> publisher.example/article

So I think it sounds reasonable not to let the publisher know the SXG distributor's URL.

And also if the publishers can know the distributor's URL, this can be used for user tracking.
Example:
https://TRACKING_ID.distributor.example/publisher.example/article.html.sxg
https://distributor.example/TRACKING_ID/publisher.example/article.html.sxg
I think we should avoid adding new features which can be used for user tracking.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Network Error Logging discussion (issue #99 and its referenced comment) and review the redirect and distributor-URL examples in this issue. Determine whether publisher disclosure is permitted and whether the tracking scenarios require a specification change; done means recording a resolved decision about Signed Exchange Reporting.

Written by the indexing model from the issue text.

Assessment

Domain
security, web-dev
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.