Clear-Site-Data integration

[apasel422]

#121 greatly expands on how user-initiated data clearing works, but we should also consider how to integrate with the site-initiated Clear-Site-Data header from https://w3c.github.io/webappsec-clear-site-data/, particularly to ensure that sites cannot abuse it in order to exceed the intended budget, while still presenting some utility such as removal of impressions from the impression store prior to their natural expiry, e.g. in case of erroneous metadata.

[martinthomson]

This seems straightforward: clearing site data is already addressed, so we can simply refer to that spec.

[michaelkleber]

If there was doubt, I agree with Martin's implicit opinion that we should be able to use the easier "Clearing Site Data" hook rather than the more invasive "Clearing Browsing History".

[apasel422]

1. Should this deletion correspond to Clear-Site-Data: storage or Clear-Site-Data: cookies, either, or something else?

2. Given an HTTP response from origin https://bar.foo.example that sets the appropriate header, which impressions should be considered for deletion? We currently only retain an impression site, not origin, so the obvious behavior would be to match using same-site.
   And Clearing Impressions says:

   A user agent that clears state for a site must discard all saved impressions that were saved during the affected period with a matching impression site or conversion site.
   [...]
   Impressions that have a matching intermediary site may be cleared.

   So maybe we also need to look at the impression's conversion sites and intermediary site?

[csharrison]

This seems straightforward: clearing site data is already addressed, so we can simply refer to that spec.

I don't think that's true, since we probably don't want to give sites the ability to clear their budgets? Right now the clear-site-data section mentions setting budgets to 0.

[martinthomson]

Oh, you would prefer that this not lead to budgets being set to 0. OK, we can do that. We don't need to do that in this case.

[martinthomson]

I think that I've concluded that we probably want "impressions" as a new item for Clear-Site-Data. That's not great, because we'd need to properly work through how that works in order to integrate, but I think that we should do it right.

There is the question about whether we want further refinement about that, but I think that the goal here is to ensure that there is a basic control. I don't know that we need to worry about slicing it any finer than that (impressionsThatISaved vs impressionsThatIMightConvert...).

[martinthomson]

Summary of discussion on 2025-05-13: it makes sense to clear impressions for the conversion site only. Impression sites don't see any effect from the impressions they saved.

We'll need to come back to this once we have more clarity about intermediary sites, but the tentative view is that these would be conversion-side as well.