Page MenuHomePhabricator

Set expiry time for GeoIP cookies
Open, MediumPublic

Description

GeoIP cookies are session cookies. However, on some platforms, they can last a long time. They can also stick around if users keep restoring previous browser sessions. People and devices travel, so let's instead set a reasonable expiry time for these cookies.

Event Timeline

AndyRussG raised the priority of this task from to Needs Triage.
AndyRussG updated the task description. (Show Details)
AndyRussG moved this task to Triage on the Fundraising-Backlog board.
AndyRussG subscribed.

This has been idle a while, but it's still probably a good idea. Does anyone have thoughts on an appropriate lifetime? My initial thought is we should be targeting something in the 4-12 hour range.

Is there any possibility of this being prioritised?

Tgr subscribed.

This can be quite confusing. I still have a US geoip cookie, even though I haven't been in the US for almost five months now, and have restarted the browser and the machine countless times since then.

This can be quite confusing. I still have a US geoip cookie, even though I haven't been in the US for almost five months now, and have restarted the browser and the machine countless times since then.

I've made it 15 months so far with a cookie from the wrong continent, as described in T315490. If you have session restore turned on in your browser, the cookie essentially becomes a permanent indicator of where you were when you first visited the site.

I believe the GeoIP cookie is set by Varnish, which is maintained by Traffic.

Important comments from T175691:

It's not a negligible number of users whose GeoIP location does not correspond to the location identified using their IP on the server when we process the server logs. Counting only users who are targeted by CN, this month it varied between 10 and 100 pageviews per minute.

(Edited: Fixed numbers and link to graph.)

This also prevents me from making a card donation (via the donation link in the sidebar menu, but I imagine clicking on a banner would have the same effect), as the geoip cookie is used to determine what kind of credit card form to show, and I'm greeted by a form where I would have to select a US state to proceed. (And in any case, card payment in Hungary does not require an address so it puts the would-be donor off.)

(I guess that's in part a different problem: the form should not assume that the card's issuer is in the same country that's shown by geoip...)

BCornwall triaged this task as Medium priority.Sep 8 2022, 4:04 PM