Breaks proxy caching, with privacy consequences

[Rudd-O]

User 1: visit Plone with this addon using a browser(DNT=1). fronted by e.g. a Varnish server. Plugin generates viewlet with content that tracks the browser. Varnish caches page.
User 2: visit same Plone with this addon using a browser(DNT=1). Varnish serves cached page with content that tracks the browser.

In other words: caching defeats the privacy feature.

Fix: upon install, update plone.app.caching configuration to add Vary: DNT header. Alternatively, add Vary: DNT header when viewlet render is invoked (not recommended, as this would conflict with plone.app.caching).

None of these fixes are very reliable since plone.app.caching is not necessarily installed at the time of this plugin's installation, so then we have an install ordering problem.

[Rudd-O]

Aha! I found that exact problem in this site:

http://www.brasil2016.gov.br/en/news/rio-2016-raises-the-bar-for-olympic-and-paralympic-sports

Try it yourself:

curl -H "DNT: 1" -H "Cache-Control: no-cache" -H "Pragma: no-cache" http://www.brasil2016.gov.br/en/news/rio-2016-raises-the-bar-for-olympic-and-paralympic-sports > 1
curl -H "Cache-Control: no-cache" -H "Pragma: no-cache" http://www.brasil2016.gov.br/en/news/rio-2016-raises-the-bar-for-olympic-and-paralympic-sports > 2
curl -H "DNT: 1" http://www.brasil2016.gov.br/en/news/rio-2016-raises-the-bar-for-olympic-and-paralympic-sports > 3

• 1 should not contain the buttons, and it does not.
• 2 should contain the buttons, and it does.
• 3 should NOT contain the buttons, but the cache serves the page served to 2.

[Rudd-O]

See #81 for another way in which privacy is broken.

[hvelarde]

nice catch, thanks!

CC @keul

[keul]

Yes, in my usecase DNT header and privacy cookie were added to Varnish cache configuration.
My fault. I didn't documented this when I added the feature.

[hvelarde]

I think we must load this client side the same way we did with the WhatsApp and Telegram plugins; having to maintain this in Varnish means we'll have entries duplicated for each page displaying the widgets.

[keul]

@hvelarde totally agree. Client side is the way to go

[Rudd-O]

Seems that implementing the two-click-to-like feature I requested the other day, is about to get much more straightforward.

Back to the topic: how does the page query the value of the DNT setting, in order to avoid third-party-loading the HEAD javascripts and images?

[keul]

@Rudd-O seems is possible (that's totally new for me): https://davidwalsh.name/detect-track-javascript

Not sure how well supported this is.

[hvelarde]

mostly fixed in #133.