Automattic / Automattic/jetpack
sameSite cookie issues with stats.wp.com/w.js
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
### Steps to reproduce the behavior
In this particular case, I:
1. Started a JN site and view the Jetpack dashboard.
2. View the console.
#### What I expected to happen
No errors
#### What actually happened

### Context
a8c tracks call in stats.wp.com/w.js which is the origin of these cookies.
#### Browser / OS version
Firefox Dev (92b9), macOS 11.5.1
#### Is this specific to the applied theme? Which one?
n/a
#### Does this happen on simple or atomic sites or both?
Probably both; should be happening with anything loading w.js.
#### Is there any console output or error text?
Yes:
```
Cookie “tk_tc” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite
```
#### Level of impact (Does it block purchases? Does it affect more than just one site?)
Medium. It'll likely lead to failure to track soon.
#### Reproducibility (Consistent, Intermittent) Leave empty for consistent.
#### Screenshot / Video: If applicable, add screenshots to help explain your problem.
Contributor guide
Research direction
Start by reproducing the warning in Firefox Dev while viewing the Jetpack dashboard, then inspect the cookie setup in stats.wp.com/w.js, identified as the origin of tk_tc. Done means the SameSite warning no longer appears and tracking continues to work; the issue does not name a repository file or test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- analytics, security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100