matomo-org/matomo

Tracking code generator incorrectly sets domains for websites that use www in the hostname

Open

#19,844 opened on Oct 11, 2022

View on GitHub
 (0 comments) (0 reactions) (0 assignees)PHP (21,513 stars) (2,847 forks)batch import
Help wanted

Description

When setting the URL for a website, we specify that it isn't necessary to specify URLs with and without www as Matomo handles both automatically. This means that people can set their URL to either www.example.org or to example.org: image

However, when the option "Track Visitors across all subdomains" is selected in the tracking code generator it incorrectly sets the domains and cookie domains to *.www.example.org when the website URL contains www: image

This can cause issues with the cookies on the websites tracked with things such as cookie consent tools that are quite strict and can cause issues with other things such as server-side tracking that relies on fetching the Visitor ID value from cookies

Contributor guide

Tech stack
None
Domain
backend
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
None
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75
Research direction
The bug is in the tracking code generator that constructs the ` paq.push(['setCookieDomain', ...])` and ` paq.push(['setDomains', ...])` lines. The code likely extracts the hostname without stripping the 'www.' prefix, resulting in incorrect wildcard domains. Look for files related to tracking code generation, such as in `plugins/Morpheus/templates/` or `core/Tracker/`. The fix should strip 'www.' from the hostname before generating the domain strings. Review the existing logic for handling URLs with 'www' and ensure the subdomain wildcard is applied to the bare domain.