Consider limiting the number of sources a reporting origin can register per initiated navigation

[johnivdel]

Because the API supports source registrations on both background attribution redirects, and foreground navigation redirects, a single reporting origin can potentially register many navigation sources in response to a single initiated navigation.

[apasel422]

To clarify, there are two axes on which the same reporting origin can register multiple navigation sources from the same navigation:

1. Background and foreground chains
2. Redirects within either a background or foreground chain

Restricting either axis would be a breaking change.

[linnan-github]

To clarify, there are two axes on which the same reporting origin can register multiple navigation sources from the same navigation:

1. Background and foreground chains
2. Redirects within either a background or foreground chain

Restricting either axis would be a breaking change.

Also, fenced frame beacons can also registration ARA from navigation.

[apasel422]

Another complication is that a single user activation can call window.open multiple times, which technically correspond to multiple navigations.

[apasel422]

Another complication is that a single user activation can call window.open multiple times, which technically correspond to multiple navigations.

I was wrong about this. Per MDN:

Modern browsers have strict popup blocker policies. Popup windows must be opened in direct response to user input, and a separate user gesture event is required for each Window.open() call.

[apasel422]

Would excess registrations here be rejected or downgraded to event sources? Perhaps there's an argument for allowing the reporting origin to configure this.