Automattic / Automattic/jetpack

sameSite cookie issues with stats.wp.com/w.js

Open
#30,097 1 comment 0 reactions 0 assignees View on GitHub
[Feature] Tracks [Package] Connection [Plugin] Jetpack [Pri] Low Bug x-site cookies
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

### Steps to reproduce the behavior
In this particular case, I:
1. Started a JN site and view the Jetpack dashboard.
2. View the console.

#### What I expected to happen
No errors

#### What actually happened
![2021-08-31 at 10 24 AM](https://user-images.githubusercontent.com/88897/131530993-935b0c34-f91a-40e8-a0e8-e08d1505e72a.png)

### Context
a8c tracks call in stats.wp.com/w.js which is the origin of these cookies.

#### Browser / OS version
Firefox Dev (92b9), macOS 11.5.1

#### Is this specific to the applied theme? Which one?
n/a

#### Does this happen on simple or atomic sites or both?
Probably both; should be happening with anything loading w.js.

#### Is there any console output or error text?
Yes:
```
Cookie “tk_tc” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite
```

#### Level of impact (Does it block purchases? Does it affect more than just one site?)
Medium. It'll likely lead to failure to track soon.

#### Reproducibility (Consistent, Intermittent) Leave empty for consistent.

#### Screenshot / Video: If applicable, add screenshots to help explain your problem.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the warning in Firefox Dev while viewing the Jetpack dashboard, then inspect the cookie setup in stats.wp.com/w.js, identified as the origin of tk_tc. Done means the SameSite warning no longer appears and tracking continues to work; the issue does not name a repository file or test.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
analytics, security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.