search

WICG / trust-token-api

Trust Token API
https://wicg.github.io/trust-token-api/
Other
421 stars 84 forks source link

Consider dropping the 'trust-token-redemption' feature policy? #106

Open zhengweiwithoutthei opened 2 years ago

zhengweiwithoutthei commented 2 years ago

According to https://docs.google.com/document/d/1TNnya6B8pyomDK2F1R9CL3dY10OAmqWlnCxsWyOBDVQ/edit?usp=sharing

Token redemption and request signing will be available in cross-origin frames, but using them will require the trust-token-redemption Feature Policy feature to be enabled.

However, it is not uncommon the ad tag is loaded inside a cross-origin iframe where the ad tach company has no control of. In some cases, this number can be over 50%. It is not practical to reach out to all affected publishers to add the feature policy to their iframes.

Removing this feature policy should significantly increase the trust token coverage.

SpaceGnome commented 2 years ago

+1 for removing this given how some ad tags can be loaded in a cross-origin iframe.

bvattikonda commented 11 months ago

Any update on this?

kakadiyahardik commented 8 months ago

Hi team, any updates on this?

aykutbulut commented 2 months ago

Thanks for raising this and your patience.

Current opt-in model requires sites to explicitly allow iframes for token operations. This is helpful considering there can be at most 2 distinct issuers per top level page.

However, your concerns are valid and we are looking for solutions to alleviate the adoption pains for pages and IVT vendors.