The ahoy_track cookie does appear to be cross-domain friendly

[moxie]

Hi there,

I'm working with a fairly old version of Ahoy in my project, but the bit of code I'm wrestling with is still present in master.

The following is from tracker.rb on master. See comment just inside the if defer conditional block.

def track_visit(defer: false, started_at: nil)
  if exclude?
    debug "Visit excluded"
  else
    if defer
      # Why is this 4th argument (Which set_cookie defines as use_domain) false here?
      set_cookie("ahoy_track", true, nil, false)
    else
      delete_cookie("ahoy_track")

      data = {
        visit_token: visit_token,
        visitor_token: visitor_token,
        user_id: user.try(:id),
        started_at: trusted_time(started_at),
      }.merge(visit_properties).select { |_, v| v }

      @store.track_visit(data)

      Ahoy::GeocodeV2Job.perform_later(visit_token, data[:ip]) if Ahoy.geocode && data[:ip]
    end
  end
  true
rescue => e
  report_exception(e)
end

This false on use_domain stops Ahoy's JS from attempting to hit the /visits endpoint, which would persist the Visit in my store.

Example, I have a route that is on www but then redirects the visitor to some subdomain. I'm trying to work with the scenario where the visitor to my www URL has never been to our site before and thus, has no ahoy_visit and ahoy_visitor cookies set.

When the visitor hits the www route, Ahoy::Controller calls set_ahoy_cookies to set my visit and visitor IDs. It sets those cookies respecting Ahoy.cookie_domain = :all setting in my configuration. The ahoy_track cookie however, is created via set_cookie with use_domain set to false. This means that cookie is set specifically to my www domain and cannot be read by the subdomain where I will ultimately redirect the visitor.

The end result, is when the user lands on my subdomain, they have the following cookies:

• ahoy_visit: XXXX-XXXX (Domain .mydomain.com)
• ahoy_visitor: XXXX-XXXX (Domain .mydomain.com)
• ahoy_track: true (Domain www.mydomain.com) *The troubled one

Because the JS firing on the now subdomain can't read the ahoy_track cookie, it never makes an attempt to hit /visits and actually persist the Visit.

Is this intentional?

Doesn't it seem like if Ahoy.cookie_domain = :all the ahoy_track cookie should also respect that policy and allow this cookie to be read cross domain?

This seems intentional and has persisted many versions, so I want to get a sense of whether or not I'd be getting into trouble submitting a PR to alter this behavior.

Thank you!

[moxie]

I understand why this is happening. Thank you :)