Issue with Domain Restrictions in Protected Audience API Documentation

[michaeld79]

Hello,

I wanted to bring your attention to an issue I noticed in the current documentation of the Protected Audience API. Specifically, I would like to discuss the domain restrictions related to the biddingLogicUrl, biddingWasmHelperUrl, dailyUpdateUrl, and trustedBiddingSignalsUrl parameters.

According to the documentation, these URLs must have the same origin as the owner, which can be a constraint in the long run. However, I believe it would be beneficial to allow restrictions at the domain level rather than at the subdomain level.

Consider a scenario where dynamic content and static content are served from the same subdomain. If this subdomain is pointing to a CDN solution, the trustedBiddingSignalsUrl could incur substantial costs compared to the static files like biddingLogicUrl.

I suggest using a restriction in domain level such as dynamic.somedomain.com and static subdomains like static.somedomain.com this will restrict the ownership for 'somedomain.com' but allow the subdomain to be routed to other sources.

Thank you for considering this suggestion. Please let me know if you require any further clarification or information.

[rdgordon-index]

Also see #813

[JensenPaul]

As discussed in the 6/5/2024 Protected Audience WICG call, this issue was determined to be a duplicate of #813, so I'm closing it. If you have further concerns, feel free to reopen this issue or file another issue.