Question for https://example.com/.well-known/privacy-sandbox-attestations.json

[hykim321]

Hi, I have a question

https://developers.google.com/privacy-sandbox/relevance/enrollment?hl=ko

According to the documentation, my understanding is that the data must be sent using the root domain: https://example.com/.well-known/privacy-sandbox-attestations.json.

Can't we send this as a subdomain?
For example, I would like to send it to a subdomain in the form https://foo.example.com/.well-known/privacy-sandbox-attestations.json.
Please respond in this regard.

[GeorgiaFranklin]

Hello there,

Subdomain validation is not currently supported by our attestation validation process at this time. This is outlined in our Enrollment Developer Guide See section titled "Upload your Attestation file".

Can you provide more explanation as to why you would prefer to host the file on a sub-domain?

[jyfhsszq]

Most of the companies usually don't host service for https://example.com. All traffics to https://example.com are redirected to https://www.example.com by default. To support attestation file under https://example.com, it requires big exceptional rule change on infra. It is huge risk for security and stability. Several same concerns were reported as well in this ticket. Could you please change your policy to make subdomain available? privacysandbox/attestation#36