3 ms·

Isn't the actual problem with Chrome's behavior and as=document that they still leak? If a.test preloads b.test/i_have_visited_a.html and it is added to b.test'

• londons_explore 5y ago
  Correct. as=document reintroduces a data leak between different domains, and therefore isn't viable. The only solution is not to allow cross-origin document preloads. Which is lame because the impact on user experience is reasonably substantial.
  • jefftk 5y ago
    How is as=document more of a leak than ordinary cross-site navigation?
    • kevincox 5y ago
      Because you can do this without navigating the user. You are correct that this can be accomplished by redirecting to the tracker site and back but this is 1) detrimental to user experience so not frequently done. 2) Easier to detect and block as the behaviour is suspicious 3) Means that your site breaks if the tracker site is down. This is especially an issue if you want to "register" the session with multiple trackers. With preload you can do this in the background very efficiently.
      • jefftk 5y ago
        Hmm, I think you're right, there may be a problem here. Unlike any other request you can trigger on a page in a browser that blocks third-party cookies, if a.test has <link rel=prefetch as=document href=b.test> this will send b.test's first-party cookies. This allows cross-site tracking through link decoration without having to navigate the top-level page.