demo · v132
Buyer-worklet view: how nonces gate “additional bids”
The buyer-side flow that motivated the hardening. A buyer worklet receives an auction nonce from the seller, derives a per-bid nonce, then signs additional bids. v132 tightens replay rules so a buyer cannot reuse the same nonce across runs or auctions. Step through the flow and try the “malicious reuse” toggle.
// buyer worklet (bidder.js) in Chrome 132+
function generateBid(interestGroup, auctionSignals, perBuyerSignals, trustedBiddingSignals, browserSignals) {
const auctionNonce = browserSignals.auctionNonce; // unique per runAdAuction()
const bidId = crypto.randomUUID();
// additional-bid path: bid carries the nonce; helper-side ledger refuses replays
return { bid: 1.50, render: "https://ad.example/creative/" + bidId, nonce: auctionNonce };
}