[jira] [Created] (UNOMI-1005) The web tracker and the server disagree on cookies across sites

["Serge Huber (Jira)" <ji...@apache.org>]

Serge Huber created UNOMI-1005:
----------------------------------

             Summary: The web tracker and the server disagree on cookies across sites
                 Key: UNOMI-1005
                 URL: https://issues.apache.org/jira/browse/UNOMI-1005
             Project: Apache Unomi
          Issue Type: Bug
    Affects Versions: unomi-4.0.0
            Reporter: Serge Huber
             Fix For: unomi-4.0.0


h3. Summary

In 4.0, the context.json, eventcollector and client endpoints no longer allow cookies on requests that come from another site. This was an intended change. But the web tracker shipped with Unomi still sends its requests with cookies. When the website and Unomi are on different domains, the browser blocks the answer, so tracking stops working. It worked in 3.0.1.

Note: the visitor cookie uses SameSite=Lax, so browsers only send it within the same site.

The goal of this ticket is that the shipped tracker works with the shipped server when they run on different domains, or that the documentation says clearly which setups are supported.

h3. Ways to explore
* Preferred: document a same-site setup, with Unomi on a subdomain of the website or behind the website's reverse proxy.
* If cookies are allowed again for other origins, allow them only for an explicit list set by the operator. Compare scheme, host and port exactly, keep the list empty by default, and never combine it with "allow all origins" or with copying the request's origin back. Send "Vary: Origin".
* Do not change the cookie's SameSite setting.
* Do not move visitor identity into the request body or browser storage to get around this. UNOMI-975 ties a public request to the profile of its own cookie.

h3. How to test

Serve a test page from a domain other than the Unomi server's. Load the shipped tracker. Check that context.json and event requests succeed in the browser, or that the documented setup works.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)