Bounce Tracking Protection: a browser initiated navigation leaves the extended navigation's initial host empty instead of the site being navigated away from
Categories
(Core :: Privacy: Anti-Tracking, defect, P3)
Tracking
()
People
(Reporter: emz, Unassigned)
References
(Blocks 1 open bug)
Details
Split off from bug 2060310.
BounceTrackingState::OnStartNavigation only derives the record's initial host when the navigation's triggering principal is one BTP tracks. A navigation started by the browser - address bar, bookmark, session restore, tabs.update, error page - carries the system principal or a moz-extension: principal, so the initial host is left empty and exempts nothing.
That is a gap rather than the right answer. The initial host is meant to be the site the extended navigation started from, i.e. the one being navigated away from. A browser initiated navigation has such a site even though it has no initiating document, so it should be exempt here too.
Consequence
RecordStatefulBounces skips a bounce set host when it equals the initial host. With the initial host empty, the page the user was on gets classified if it reappears in the chain of the URL they typed. Concretely: the user lands on A without interacting with it, types B in the address bar, and B bounces through A to C. A is in the bounce set, is neither initial nor final host, and has no user activation, so A is classified and purged - even though the user visited it directly. The initial host exemption exists precisely to prevent that.
The observable delta is narrow: it only changes an outcome when the site being navigated away from reappears in the chain of the browser initiated navigation. In most cases the user has interacted with the previous page, so the 45 day user activation exemption already covers it.
Description
•