feat(web-analytics): remove cookieless_server_hash_mode team setting#51311
Open
lricoy wants to merge 9 commits into
Open
feat(web-analytics): remove cookieless_server_hash_mode team setting#51311lricoy wants to merge 9 commits into
lricoy wants to merge 9 commits into
Conversation
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
3832369 to
be01514
Compare
Contributor
|
Size Change: -6.91 kB (-0.01%) Total Size: 81 MB 📦 View Changed
ℹ️ View Unchanged
|
Contributor
Visual regression: Storybook UI snapshots updatedChanges: 3 snapshots (3 modified, 0 added, 0 deleted) What this means:
Next steps:
|
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
7ad6047 to
efe2abb
Compare
Contributor
Visual regression: Storybook UI snapshots updatedChanges: 1 snapshots (1 modified, 0 added, 0 deleted) What this means:
Next steps:
|
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
f23bd72 to
7c04ab7
Compare
Contributor
Migration SQL ChangesHey 👋, we've detected some migrations on this PR. Here's the SQL output for each migration, make sure they make sense:
|
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
9334952 to
a5df90f
Compare
Contributor
Storybook visual regression tests failedIf your changes intentionally update UI snapshots: add the If you didn't change any UI: this is likely a flaky snapshot — wait for a fix to land on master. |
Contributor
|
This PR hasn't seen activity in a week! Should it be merged, closed, or further worked on? If you want to keep it open, please remove the |
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
d0194a7 to
2edf3dc
Compare
Contributor
|
This PR was closed due to lack of activity. Feel free to reopen if it's still relevant. |
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
2edf3dc to
26a676c
Compare
Contributor
|
🎭 Playwright didn't run on this PR — your changes touch code that could affect E2E behavior, but Playwright is opt-in via label now to keep CI cost down. Add the Most PRs don't need this. Real regressions still get caught on master and fix-forward. |
Contributor
|
👋 Visual changes detected for this PR. Review and approve in PostHog Visual Review If these changes are unexpected, they may be caused by a flaky test or a broken snapshot on master. Don't approve — rerun the job or wait for a fix. |
Contributor
Query snapshots: Backend query snapshots updatedChanges: 1 snapshots (1 modified, 0 added, 0 deleted) What this means:
Next steps:
|
Member
Author
|
🤖 Brought the branch up to master (was ~1k commits behind) and tightened a few loose ends:
Prod stateless usage check — the PR description said no team uses stateless mode; reality is a small number do. Behavior under this PR is to auto-migrate them to stateful, which matches what we want. Per-region check (Postgres
CI is rerunning against fresh master. Asking for bot reviews — would love to merge as soon as they're happy. |
lricoy
changed the title
Member
Author
|
Marking it ready so I can check the bot reviews first |
Contributor
|
Reviews (1): Last reviewed commit: "Merge branch 'master' into lricoy/remove..." | Re-trigger Greptile |
lricoy
commented
May 27, 2026
| human_friendly_comparison_periods = field_access_control( | ||
| models.BooleanField(default=False, null=True, blank=True), "project", "admin" | ||
| ) | ||
| # DEPRECATED: This field is no longer read. All cookieless events are processed as stateful. |
Member
Author
There was a problem hiding this comment.
Just to be clear, I plan to remove it in a follow-up PR, just focusing on making the functionality sound first and then do the clean up
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
ba06366 to
cfcfe73
Compare
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is a cross-team removal of a cookieless server hash mode setting touching feature-flags and ingestion teams, and the size gate tripped (509L/17F). The change is low-risk cleanup, but cross-team behavioral changes to the Rust cookieless manager and Node.js ingestion path need sign-off from @PostHog/team-feature-flags and @PostHog/team-ingestion, not just web-analytics.
18 updated Run: 6e789da3-5617-4c20-bd69-778db24d0e0e Co-authored-by: lricoy <2034367+lricoy@users.noreply.github.com>
lricoy
force-pushed
the
lricoy/remove-cookieless-team-setting
branch
from
cfcfe73 to
20a9f58
Compare
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
| results[i] = drop('cookieless_team_disabled') | ||
| continue | ||
| } | ||
| const timestamp = event.timestamp ?? event.sent_at ?? event.now |
There was a problem hiding this comment.
Medium: Project cookieless opt-in bypass
An unauthenticated sender with a public project token can set $cookieless_mode and have the event processed as cookieless even when cookieless mode is not enabled for the project. That path strips $ip, $raw_user_agent, and event.ip, so the sender can bypass the project-level admin choice and avoid IP/user-agent based enrichment or bot detection; keep a server-side project allowlist/gate here, or only accept the marker from a trusted SDK-controlled path.
Contributor
There was a problem hiding this comment.
This bot's comment seems relevant btw
PR overviewThis pull request removes the There is one open security issue: clients can currently mark events as cookieless even when the project has not opted into cookieless mode. This lets an unauthenticated sender with a public project token bypass the project’s configured ingestion behavior and avoid IP/user-agent based enrichment or bot-detection paths. No issues have been addressed yet, so the PR still needs a server-side project gate or trusted-source check before this behavior is safe. Open issues (1)
Fixed/addressed: 0 · PR risk: 6/10 |
jose-sequeira
approved these changes
Jun 3, 2026
eli-r-ph
approved these changes
Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Users need to enable cookieless tracking in two places: the SDK config AND the project settings. This is confusing and causes support tickets when users enable it in the SDK but forget the project setting.
Additionally, the stateless mode is not used by any projects and adds unnecessary complexity.
Changes
cookieless_server_hash_modefrom exposed fieldsHow did you test this code?
Publish to changelog?
Yes