3 ms·
> Override the Host header to be equal to GTM-123456.fps.goog. Allow all cookies and query strings to be forwarded. Did a security team review this? This leaks
by AaronFriel 2y ago
> Override the Host header to be equal to GTM-123456.fps.goog. Allow all cookies and query strings to be forwarded.
Did a security team review this? This leaks session cookies for your domain to Google in a way GTM did not previously capture.
- mschuster91 2y ago> This leaks session cookies for your domain to Google in a way GTM did not previously capture. Only if you set up your session handler to emit cookies that apply to all subdomains instead of using the __Host- prefix and the SameSite=strict attribute [1]. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
- Sayrus 2y agoI think the load balancer is the one forwarding all cookies to Google with this configuration. The browser has already sent this to your own domain/LB as first-party mode introduces yourdomain.com/page and yourdomain.com/metrics.
- lbarrow 2y agoI don't think this would prevent the session cookie from being sent to tag manager. The tag manager document describes setting up a specific path on the website's normal domain, not using a subdomain.
- charrondev 2y agoYou can issue cookies on a sub path though.
- toast0 2y agoYou can, but it's typical to use / for login cookies. And I don't think you can issue cookies that exclude a sub path.
- AaronFriel 2y agoThis is incorrect, the documentation in the article involves configuring an L7 load balancer to route a path on the same domain as the origin to Google Tag Manager. This means even `SameSite=strict`, `Secure`, `HttpOnly` cookies will be sent to GTM, if the instruction I quoted is followed to pass all cookies and query strings. It's weird that the document specifically says "all cookies" - that gives GTM access to every cookie sent to your application.