Information on reportWin and sendReportTo

[vincent-grosbois]

Hello!
We've noticed from Chromium that in the reportWin JS function, there is the possibility to call a newly-created function "sendReportTo"
I wanted to ask some questions on this as I couldn't find everything in the source code:

• what is going to be the availability of this function ? is it something for the OT only or for beyond OT ? If so should it be documented in the Fledge spec?
• it is currently plugged in ? ie does calling sendReportTo do anything?
• can you share with us how the actual report will be sent to the URL ? ie will it transfer data via a POST request etc. Also what is the data that will be sent ? can we assume it is the arguments of the reportWin() function?

thanks!

[rowan-m]

Hey @vincent-grosbois I see this was covered in one of the earlier meetings. Does this cover your questions or is there more detail to go into?

[vincent-grosbois]

Hi @rowan-m I've read the transcript but it seems it doesn't cover my questions. Or rather, from this understand that this system would be available for the OT (I guess), but I'm still lacking most of the technical details that allows us to process the info:

• can you share with us how the actual report will be sent to the URL ? ie will it transfer data via a POST request etc. Also what is the data that will be sent ? can we assume it is the arguments of the reportWin() function?
• it is currently plugged in ? ie does calling sendReportTo do anything? (for this I could check chromium source code but I didn't find anything, so I guess it's not plugged in)

[vincent-grosbois]

Another question I'm adding:

• are there any plans for enconding/signing the payload of sendReportTo ? The issue with sending payload "in clear" is that this is not robust to replay attack, or even just someone creating a fake request from scratch, and the content of this payload is supposed to define the billing. I know it's a big topic but do you have any insights on this?