What qualifies as a reporting origin? [question]

[maudnals]

Question from developer:

For reporting origin, will it be the origin in attributionsrc or the server origin that responds with attribution-reporting-register-source header?

What happens with the reporting origin if redirects are used?

[maudnals]

Answer:

The reporting origin is the server origin that responds with the Attribution-Reporting-Register-Source header. (Side note: reports can only be generated if source events AND trigger events are registered by that same origin).

Redirects work as follows:

• At source registration time:
  • adtech1 receives a request from the browser that contains Attribution-Reporting-Source-Info
  • adtech1 responds with a request that contains the Attribution-Reporting-Register-Source header. It can be a normal request or, for this example, it can also be a redirect request. Let's make this a redirect request to to adtech2.
  • The browser receives this response; it sees Attribution-Reporting-Register-Source and stores a source event.
  • The browser also sees this is a redirect; so it makes a new request to adtech-2 that also includes the Attribution-Reporting-Source-Info header
  • adtech2 responds with a normal response that contains the Attribution-Reporting-Register-Source header.
  • The browser receives this request; it sees Attribution-Reporting-Register-Source and stores a source event, using adtech2 as the reporting origin.
• At trigger time, requests can be redirected in the same way. Source event and trigger events that have been generated by the same origins will be matched—respectively, adtech1 and adtech2.