1642007 - Add user interaction requirement to dFPI interaction heuristic

Status: NEW

(Core :: Privacy: Anti-Tracking, task, P3)

Description

[Steven Englehardt [:englehardt]]

The dFPI interaction heuristic implemented in Bug 1616585 Comment 12 can be summarized as:

Site B will receive storage access on site A when a top-level document redirect occurs from site B to site A, where:
* both site A and site B have received user interaction as a first-party within the past 30 days
* both site A and site B been visited as a first party within the past 10 minutes

We should add in an additional requirement that the navigation from Site B to Site A was the result of user interaction.

Comment 1

[Johann Hofmann [:johannh]]

I'll note that "result of user interaction" can be very difficult to correctly define so that it's compatible with all the async stuff that websites are doing these days and things like forwarding, redirecting, bouncing etc.

There is a flag on document that has this information but it might be based on the simple single-stack user interaction flag. We should at least use the user activation API (which has a 5s timer) to ensure better compatibility.