Feature request: Provide low-entropy UACH on updateURL fetches

[dmdabbs]

PA updateURL fetches' utility could be improved with the inclusion of low entropy UACH. Opening this issue per suggestion in the 31 July WICG discussion. While buyers can work around by encoding the info into the updateURL, this adds complexity and unnecessarily consumes IG on-device space.

Chrome Canary net-log trace from 31-July:

GET /fetch/updateurl HTTP/1.1
Connection: keep-alive
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9

[JensenPaul]

We’ve been investigating this ask for the low-entropy UACH headers on interest group update requests. Today these requests do not have these UACH headers. Chrome does not attach them, and the browser is not specified to include them: the requests are issued with a null client which means the UACH are not attached due to lack of permissions policies. The reason for the null client is that these requests are not meant to be associated with a particular web page. As the explainer says: “An update request only contains information from the single site where the user was added to the interest group” We want to prevent data from other sites from being included in these requests. The low-entropy UACH headers are controlled by four different permission policies. Were we to associate these requests with the page conducting the auction that triggered the post-auction interest group updates, then we would be exposing four bits of data from that page in the update request, represented by the presence or lack of UACH headers due to the permission policies of that page. The page where the user was added to the interest group is likely long since unloaded and hence cannot easily be associated with the update request. This is all to say that I don’t foresee an easy way to add low-entropy UACH headers to interest group update requests.

[dmdabbs]

The low-entropy UACH headers are controlled by four different permission policies....

Thanks Paul. Appreciate the explanation.