Permissions-Policy: attribution-reporting directive
Deprecated
To be removed
This feature is pending removal from browsers. Using it now may lead to broken functionality in future updates. Following the announcement that Chrome will maintain its current approach to third-party cookies, Chrome decided to withdraw certain Privacy Sandbox features including the attribution reporting API.
Non-standard: This feature is not standardized. We do not recommend using non-standard features in production, as they have limited browser support, and may change or be removed. However, they can be a suitable alternative in specific cases where no standard option exists.
The HTTP Permissions-Policy header attribution-reporting directive controls whether the current document is allowed to use the Attribution Reporting API.
Specifically, where a defined policy blocks the use of this feature:
- Background
attributionsrcrequests won't be made. - The
XMLHttpRequest.setAttributionReporting()method will throw an exception when called. - The
attributionReportingoption, when included on afetch()call, will cause it to throw an exception. - Registration headers (
Attribution-Reporting-Register-SourceandAttribution-Reporting-Register-Trigger) in HTTP responses on associated documents will be ignored.
Syntax
Permissions-Policy: attribution-reporting=<allowlist>;
<allowlist>-
A list of origins for which permission is granted to use the feature. See
Permissions-Policy> Syntax for more details.
Default policy
The default allowlist for attribution-reporting is *.