Consider removing landing page destination restriction

[csharrison]

Currently in the API for navigation sources, we have a restriction that a user must land on the destination site for the source to be valid. Otherwise, the source registration is ignored.

We are hearing cases of legitimate use-cases where this restriction is difficult to conform to, e.g.

• Landing pages that are managed by third parties with different domains than the advertiser site
• Conversion pages that are managed by third parties (e.g. purchase flows) on a different domain than the advertiser site or landing page

Additionally, the restriction in the API is no longer fully “load bearing” because event sources already have the capability to leak some amount of browsing history, which we protect with noise that is also present on navigation sources. Therefore it doesn’t feel as necessary to add additional protections on clicks which are already rate-limited by user interaction.

Note: this doesn’t fully solve the use cases detailed in #549 but it does partially solve the case where only a single domain is required to register conversions. Note that this also partially fixes #44.

[csharrison]

Another issue that is solved by this: there are cases where the "redirect chain" includes JS-redirects, not just HTTP redirects. In the following case:

• User clicks ad on publisher site for advertiser.com, which first pings ad1.com
• Response from ad1.com, 302 redirect to ad2.com
• Response from ad2.com navigates to ad2.com, JS-redirect using window.location to ad3.com
• ad3.com does an HTTP redirect to advertiser.com

If all the ad1,ad2,ad3 respond properly with registration headers.

• In the current API: none of the registrations will succeed
• In the API after landing page restriction is removed, ad1,ad2 registrations will succeed. ad3 will still fail because of the user-gesture constraint.

cc @linnan-github

[logicad]

I support this proposal 👍

[mwakkiy]

I also support this proposal.
We have several cases with our clients where Landing pages and Conversion pages have different domains.

[apasel422]

This would also simplify the implementation, which currently has to buffer sources until the landing page destination is known.