This is a test site for the PPCA proposal by webkit https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/. 
This spawns a local server which we can hit using safari developer preview.

This is intended as a toy project to test various edge cases around PPCA to understand it better and see which parts are unspecified.

Prerequisites
-------------

* Install nodejs using your favorite package manager
* Install safari developer preview and enable the ad click attribution feature as well as the debug feature.
  https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/
* Clone this repository

Using the localserver
---------------------

* First generate certificates for your server in this repo directory

openssl req -x509 -nodes -days 30 -newkey rsa:2048 -keyout key.pem -out certificate.pem -config req.conf -extensions 'v3_req'

* Add certificate.pem to your keychain and double click to trust it

For example like in https://tosbourn.com/getting-os-x-to-trust-self-signed-ssl-certificates/

* Add the following lines to the beginning of your /etc/hosts file

127.0.0.1 search.example
127.0.0.1 shop.example

* Start the node server

node server.js

* Restart safari and visit https://search.example

Findings so far
---------------
* Safari does not support custom ports in the conversion redirect url even if the main site loads on a custom port.
* Safari does not support altsvc so the interaction between reporting and altsvc is not specified
* Safari loads each link on its own connection
* Surprisingly the design requires the publisher to specify attribution data, however the advertiser more likely 
  has more knowledge about the conversion and the value of the conversion.