Allow configuring the cookie domain - #51
Open
loevgaard wants to merge 1 commit into
Open
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## fix/28-fbp-cookie #51 +/- ##
=======================================================
+ Coverage 81.42% 82.29% +0.87%
- Complexity 157 164 +7
=======================================================
Files 33 34 +1
Lines 506 531 +25
=======================================================
+ Hits 412 437 +25
Misses 94 94 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
loevgaard
force-pushed
the
fix/28-fbp-cookie
branch
from
September 7, 2026 12:03
eb5e4ab to
4bb3064
Compare
loevgaard
force-pushed
the
fix/29-cookie-domain
branch
from
September 7, 2026 12:03
3f605cd to
d692d8b
Compare
loevgaard
force-pushed
the
fix/28-fbp-cookie
branch
from
September 7, 2026 12:18
4bb3064 to
0cb43bc
Compare
loevgaard
force-pushed
the
fix/29-cookie-domain
branch
from
September 7, 2026 12:18
d692d8b to
17decfb
Compare
loevgaard
force-pushed
the
fix/28-fbp-cookie
branch
from
September 7, 2026 12:46
0cb43bc to
11986eb
Compare
loevgaard
force-pushed
the
fix/29-cookie-domain
branch
from
September 7, 2026 12:47
17decfb to
8132598
Compare
loevgaard
force-pushed
the
fix/28-fbp-cookie
branch
from
September 7, 2026 12:51
11986eb to
25b8339
Compare
loevgaard
force-pushed
the
fix/29-cookie-domain
branch
from
September 7, 2026 12:51
8132598 to
1b315b0
Compare
Meta writes the fbp and fbc cookies on the registrable domain and encodes that level in the value. The bundle wrote host-only cookies while always claiming level 1, so apex and www got different cookies whose values disagreed with where they were set. Add cookies.domain and cookies.lifetime, and derive the subdomain index from the domain the cookie is actually written on. Fixes #29
loevgaard
force-pushed
the
fix/28-fbp-cookie
branch
from
September 7, 2026 12:57
25b8339 to
9040b2c
Compare
loevgaard
force-pushed
the
fix/29-cookie-domain
branch
from
September 7, 2026 12:57
1b315b0 to
2844117
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #29
Problem
Meta writes
_fbpand_fbcon the registrable domain and encodes the level it used in the second segment of the value:fb.1.meansexample.com,fb.2.meanswww.example.com,fb.0.means a single label host.The bundle created host-only cookies, because no domain was ever passed to
Cookie::create(), while the SDK value objects default the subdomain index to 1. So onwww.example.comthe cookie was scoped to that host but its value claimed it was set on the registrable domain. A visitor moving between the apex,wwwand a checkout subdomain got different cookies, and the browser pixel could write its own domain cookie alongside the server's host-only one, giving one person two_fbpvalues.Change
New options:
A new
Cookie\CookieDomainservice answers two questions: which domain to write on, and what subdomain index goes with it. The index is the number of dots in the domain the cookie actually ends up on, which is exactly how Meta's own parameter builder computes it:It is capped at 2, since the SDK asserts the value is 0, 1 or 2.
Crucially the index is applied where the value is created, in
GeneratedFbpContextandQueryBasedFbcContext, not where the cookie is written. That keeps the value in the cookie and the value sent to Meta identical. A value parsed from an existing cookie keeps the index it already had.Tests
Ten unit tests for
CookieDomaincovering configured domains, a leading dot, a capped deep subdomain, the request host fallback and the no-request case, plus two new tests each forGeneratedFbpContext,QueryBasedFbcContextandStoreFbpSubscriberasserting the index and the written domain line up.