Origin trial tokens domains

[lbdvt]

Hi,

Criteo scripts running on publishers' and advertisers' pages may be served from two different domains (criteo.com and criteo.net).

When participating in the Topics/FLEDGE/Attribution Reporting Origin Trials, is there any constraint between:

• The domain mentioned at token registration time
• The origin a script, calling an OT API, is being served from
• The iframe origin a script, calling an OT API, may be embedded in
  ?

[samdutton]

The origin that you register to take part in an origin trial must match the origin of the document in which you make the JavaScript call that uses an origin trial feature.

If you want to use trial features from code that's included via a script element on a site with a different origin, you'll need to check the "Third-party matching" checkbox on the trial registration page. For example, you might want to use the Attribution Reporting API via <script src='https://criteo.example/.../ar.js'> embedded on publisher.example. In that case, register for "Third-party matching" and inject the token via script in ar.js. (See example at ot-3p.glitch.me.)

To use trial features in code in an iframe, you'll need the origin that you registered for the token to match the origin of the iframe. For example, if you want to use FLEDGE or Topics from code in <iframe src="https://criteo.example"></iframe>, the token origin must be https://criteo.example. (See example at ot-iframe.glitch.me.)

Criteo scripts running on publishers' and advertisers' pages may be served from two different domains (criteo.com and criteo.net).

Code calling document.browsingTopics() to observe topics for a user needs to match the origin of code calling document.browsingTopics() to access topics for the user, so you'll want to call that function from an iframe on sites where you want to observe topics.

To access FLEDGE or Attribution Reporting features via the trial, you could register for multiple origins, such as criteo.com and criteo.net. You can include multiple tokens in the same page if necessary: the origin trials framework looks for the first valid token and ignores other tokens. (You can validate this via Chrome DevTools.)

[antoinebisch]

[samdutton]

Doh! Thank you — fixed.