http.headers.Feature-Policy - new "browsing-topics" permission

[dmarti]

What information was incorrect, unhelpful, or incomplete?

"interest-cohort" permission appears to be missing

What did you expect to see?

Mention which browsers may use "interest-cohort" (More info at: mdn/yari#3159 )

Did you test this? If so, how?

Visited cohort test site at: https://floc.glitch.me/

MDN page report details

• Query: http.headers.Feature-Policy
• MDN URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
• Report started: 2021-04-09T19:30:10.188Z

[ddbeck]

Thanks for reporting this issue, @dmarti. This is an interesting case!

To record this data, I'd welcome a PR (from you or another contributor) adding the header to feature-policy.json. Because our schema doesn't capture origin trials right now, the feature would likely be represented as all "version_added": false values, with a note for Chrome along the lines of, "Federated Learning of Cohorts is in a Chrome origin trial. This policy affects only those versions of Chrome which may implement the origin trial." and perhaps including a link to the relevant Chrome Platform Status entry.

I'd also add that this is somewhat related to #10619. There's a little bit of uncertainty about how we record data for future or speculative features (for example, we don't generally record origin trials because of their transient nature). You can learn more about that problem in the linked issue, but I expect we'll settle on a policy that permits high-interest features in development, which this is certainly one. I wouldn't let that stop you from opening a PR, though the outcome of that discussion may prompt some changes in the final PR.

[bershanskiy]

EDIT: THIS COMMENT IS WRONG, see below!

Please note the following:

• interest-cohort directive has been removed from Chromium together with FLoC (actually, only Google Chrome really ever supported it; apparently, there was a significant controversy over this). interest-cohort was restored later.
• FLoC was ever released to a tiny population, 0.5% of Google Chrome users across 10 countries.
• there were plans/rumors that interest-cohort would also control Topics API (successor to FLoC), but no actual implementation ever manifested. For details please refer to Remove interest-cohort from Browsing Topics API GoogleChrome/developer.chrome.com#2297 . interest-cohort was restored later.

Considering the above points, I suggest we close this issue without change to BCD since interest-cohort is irrelevant in practice (although it does not fit BCD description of "irrelevant feature").

[dmarti]

The interest-cohort permission does affect Topics API, which is currently available as part of a Google Chrome origin trial.

patcg-individual-drafts/topics#70 (comment)

The new permission is browsing-topics

[bershanskiy]

@dmarti is right, I had a race condition and misinterpreted Chromium version history. In short:

• On 5 Feb Chromium commit "Remove FLoC code" landed and removed interest-cohort.
• On Mar 15, I filed Remove interest-cohort from Browsing Topics API GoogleChrome/developer.chrome.com#2297 citing that removal.
• On Mar 17, Chromium commit "[Topics] Add document.browsingTopics() API" landed and re-added interest-cohort back in.
• On May 20, my PR Remove interest-cohort from Browsing Topics API GoogleChrome/developer.chrome.com#2297 (which was erroneous by then) landed.

Therefore I plan to:

• file revert of Remove interest-cohort from Browsing Topics API GoogleChrome/developer.chrome.com#2297
• create a BCD PR which would include both interest-cohort and browsing-topics.

[MichaIng]

I'm confused, so interest-cohort is used again by Chrome and relevant to block FLoC but more importantly the new Topics API? And browsing-topics affects the Topic API as well/the same way?

Or did GoogleChrome/developer.chrome.com#2297 finally remove interest-cohort?

[dmarti]

@MichaIng The interest-cohort permission (originally implemented for Google FLoC) is still recognized as an opt out for Topics API by Google Chrome: patcg-individual-drafts/topics#70

The browsing-topics permission applies only to Topics API: https://github.com/patcg-individual-drafts/topics#specific-details

According to Google, Topics API will be made available to all Google Chrome users by the second half of 2023: https://developer.chrome.com/en/blog/expanding-privacy-sandbox-testing-2023/

[MichaIng]

Thanks for explaining. And FLoC was removed already ~1 year ago from Chrome(ium) code? Just wondering whether only browsing-topics should be used nowadays or whether additionally using interest-cohort for a while still makes sense, or even only the latter as long as if affects Tocpics API as well.

It is quite hard to find reliable information about all of this online. There are blog posts from 2023 explaining FLoC as "the new thing", as if it at least was still in use.

Sorry for abusing this issue for my questions. Probably collecting this information here at least helps anyone who finds time to implement the permissions properly into MDN. It is the source I trust most about such topics, when choosing security/privacy headers, but currently there is a gap on these 🙂.

[dmarti]

On recent versions of Google Chrome, interest-cohort does the same thing as browsing-topics. Only some origin trial versions of the browser recognized only interest-cohort but not browsing-topics.

[dmarti]

(correction: recognized interest-cohort only, or implemented FLoC)

[MichaIng]

Okay, means setting browsing-topics only is the right thing nowadays.