Saving too many impressions

[martinthomson]

What safeguards do we have to include to protect browsers from sites that dump tons of impressions on them. That might deny other sites access to the API and bog down the browser.

This also has implications on how we manage timing limits on measureConversion().

[apasel422]

It may be worth considering the intent of sites that store a large number of impressions.

For the abuse case, in which the goal is to DOS other sites with respect to the API, we may want to consider some kind of rate-limiting.

For sites that that are not deliberately abusing the API, we could consider exposing some controls that reduce the number of impressions stored, beyond simply the lifetime parameter. For example, we could allow impressions within a particular scope to be deduplicated.

[martinthomson]

There is also the option to allow sites to remove impressions they have stored to maintain storage. That is, allow them to query and remove impressions.

[apasel422]

There is also the option to allow sites to remove impressions they have stored to maintain storage. That is, allow them to query and remove impressions.

I was thinking we might want this as a finer-grained way to clean up impressions beyond Clear-Site-Data as well.

[apasel422]

If we add something like removeImpressions, it will have to be fully declarative (or, not that I'm actually suggesting this, use a worklet), IIUC, to avoid leaking whether the API was enabled, if we actually care about that.