Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

COOKIE macro #22815

Merged
merged 6 commits into from Jun 19, 2019
Merged

COOKIE macro #22815

merged 6 commits into from Jun 19, 2019

Conversation

zhouyx
Copy link
Contributor

@zhouyx zhouyx commented Jun 13, 2019

Implements #15654

@zhouyx zhouyx requested review from zikas and lannka June 13, 2019 01:11
* @param {string} name
* @return {?string}
*/
export function cookieReader(win, name) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: we could inline this method in variables.js so that we don't need to rename this file. (to avoid the filename conflict with src/cookies.js)

your call.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wanted to keep the methods in cookie.js (formerly cookie-writer.js) because I felt they support the same feature, and we are adding more logic to the #cookieReader() method.

However I realized today I can't do this, because cookie.js and variables.js import from each other then 😢

I don't want to introduce a cookie-reader file, so I'm going to move the method to variables.js.

However it seems to me variables.js has a lot of unrelated methods. I'd like to move them around later.

Copy link
Contributor Author

@zhouyx zhouyx Jun 13, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I started to move the method to variables.js, and it reminded me there's another reason why I didn't want to do that. We perform privacy check on cookie reading/writing. And I really don't like that the getCookie setCookie function to live everywhere across the code base : (

Any good ideas? If not I'm going to introduce a new cookie-reader file

Copy link
Contributor

@lannka lannka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just thought about one thing: we should not allow access cookie for inabox.

@zhouyx
Copy link
Contributor Author

zhouyx commented Jun 18, 2019

Oh definitely, FIE as well

@zhouyx
Copy link
Contributor Author

zhouyx commented Jun 18, 2019

Ok, this is more difficult than I thought. The FIE and the ampdoc share the same VariableService. There's no way for me to tell if the call is from a FIE or not. Any ideas?

@zhouyx
Copy link
Contributor Author

zhouyx commented Jun 18, 2019

Unfortunately I couldn't think of a good way to solve this. I'll need to move this to requests.js and declare this binding for each request.

@lannka
Copy link
Contributor

lannka commented Jun 18, 2019

For FIE, we disallow CLIENT_ID in a4a-variouble-source.js . COOKIE here is a bit different though.

@zhouyx zhouyx force-pushed the cookie-reader branch 4 times, most recently from 7f68d72 to e8308d2 Compare June 18, 2019 17:26
@zhouyx
Copy link
Contributor Author

zhouyx commented Jun 18, 2019

PTAL

Copy link
Contributor

@lannka lannka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. please add an integration test to make sure the macro is not available for inabox.

@zhouyx
Copy link
Contributor Author

zhouyx commented Jun 18, 2019

integration test added

@@ -186,7 +186,11 @@ app.use('/request-bank/:bid/teardown/', (req, res) => {
*/
app.get('/a4a/:bid', (req, res) => {
const {bid} = req.params;
const body = `
const preSet = `
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to not introduce custom js in the ad, you can set the cookie via HTTP response header

see https://expressjs.com/en/api.html#res.cookie

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds like a better solution. Let me try that

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Copy link
Contributor

@lannka lannka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pls also add a test case in integration/test-amp-analytics to make sure the macro works.

@zhouyx
Copy link
Contributor Author

zhouyx commented Jun 19, 2019

Addressed comments. Ready for review.

@@ -67,6 +68,7 @@ describe('amp-analytics', function() {
expect(q['b']).to.equal('AMP TEST');
expect(q['cid']).to.equal('amp-12345');
expect(q['loadend']).to.not.equal('0');
expect(q['cookie']).to.equal('test');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comment needed here

@zhouyx
Copy link
Contributor Author

zhouyx commented Jun 19, 2019

The expander is broken in singlepass. The PR is blocked by #22919

@zhouyx zhouyx merged commit 96aa80c into ampproject:master Jun 19, 2019
@zhouyx zhouyx deleted the cookie-reader branch June 19, 2019 21:04
thekorn pushed a commit to edelight/amphtml that referenced this pull request Sep 11, 2019
* create cookie-reader file

* forbid cookie in fie and inabox

* new file

* add integration test

* address comment

* add comment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants