Skip to content

Allow configuring the cookie domain - #51

Open
loevgaard wants to merge 1 commit into
fix/28-fbp-cookiefrom
fix/29-cookie-domain
Open

Allow configuring the cookie domain#51
loevgaard wants to merge 1 commit into
fix/28-fbp-cookiefrom
fix/29-cookie-domain

Conversation

@loevgaard

Copy link
Copy Markdown
Member

Fixes #29

Stacked on #50.

Problem

Meta writes _fbp and _fbc on the registrable domain and encodes the level it used in the second segment of the value: fb.1. means example.com, fb.2. means www.example.com, fb.0. means a single label host.

The bundle created host-only cookies, because no domain was ever passed to Cookie::create(), while the SDK value objects default the subdomain index to 1. So on www.example.com the cookie was scoped to that host but its value claimed it was set on the registrable domain. A visitor moving between the apex, www and a checkout subdomain got different cookies, and the browser pixel could write its own domain cookie alongside the server's host-only one, giving one person two _fbp values.

Change

New options:

setono_meta_conversions_api:
    cookies:
        domain: null          # e.g. example.com
        lifetime: '+90 days'

A new Cookie\CookieDomain service answers two questions: which domain to write on, and what subdomain index goes with it. The index is the number of dots in the domain the cookie actually ends up on, which is exactly how Meta's own parameter builder computes it:

$this->sub_domain_index = substr_count($this->etld_plus_1, '.');

It is capped at 2, since the SDK asserts the value is 0, 1 or 2.

Crucially the index is applied where the value is created, in GeneratedFbpContext and QueryBasedFbcContext, not where the cookie is written. That keeps the value in the cookie and the value sent to Meta identical. A value parsed from an existing cookie keeps the index it already had.

Tests

Ten unit tests for CookieDomain covering configured domains, a leading dot, a capped deep subdomain, the request host fallback and the no-request case, plus two new tests each for GeneratedFbpContext, QueryBasedFbcContext and StoreFbpSubscriber asserting the index and the written domain line up.

@codecov

codecov Bot commented Sep 7, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 89.65517% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.29%. Comparing base (9040b2c) to head (2844117).

Files with missing lines Patch % Lines
src/EventSubscriber/StoreFbcSubscriber.php 0.00% 3 Missing ⚠️
Additional details and impacted files
@@                   Coverage Diff                   @@
##             fix/28-fbp-cookie      #51      +/-   ##
=======================================================
+ Coverage                81.42%   82.29%   +0.87%     
- Complexity                 157      164       +7     
=======================================================
  Files                       33       34       +1     
  Lines                      506      531      +25     
=======================================================
+ Hits                       412      437      +25     
  Misses                      94       94              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Meta writes the fbp and fbc cookies on the registrable domain and
encodes that level in the value. The bundle wrote host-only cookies
while always claiming level 1, so apex and www got different cookies
whose values disagreed with where they were set.

Add cookies.domain and cookies.lifetime, and derive the subdomain index
from the domain the cookie is actually written on.

Fixes #29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant