Serge Huber created UNOMI-1005:
----------------------------------
Summary: The web tracker and the server disagree on cookies across
sites
Key: UNOMI-1005
URL: https://issues.apache.org/jira/browse/UNOMI-1005
Project: Apache Unomi
Issue Type: Bug
Affects Versions: unomi-4.0.0
Reporter: Serge Huber
Fix For: unomi-4.0.0
h3. Summary
In 4.0, the context.json, eventcollector and client endpoints no longer allow
cookies on requests that come from another site. This was an intended change.
But the web tracker shipped with Unomi still sends its requests with cookies.
When the website and Unomi are on different domains, the browser blocks the
answer, so tracking stops working. It worked in 3.0.1.
Note: the visitor cookie uses SameSite=Lax, so browsers only send it within the
same site.
The goal of this ticket is that the shipped tracker works with the shipped
server when they run on different domains, or that the documentation says
clearly which setups are supported.
h3. Ways to explore
* Preferred: document a same-site setup, with Unomi on a subdomain of the
website or behind the website's reverse proxy.
* If cookies are allowed again for other origins, allow them only for an
explicit list set by the operator. Compare scheme, host and port exactly, keep
the list empty by default, and never combine it with "allow all origins" or
with copying the request's origin back. Send "Vary: Origin".
* Do not change the cookie's SameSite setting.
* Do not move visitor identity into the request body or browser storage to get
around this. UNOMI-975 ties a public request to the profile of its own cookie.
h3. How to test
Serve a test page from a domain other than the Unomi server's. Load the shipped
tracker. Check that context.json and event requests succeed in the browser, or
that the documented setup works.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
