Because of the severe consequences of caching session cookies (T256395, T55032), it is not possible to cache a response with Set-Cookie headers. Special:HideBanners is hitting one of the layers of protection that we have against this, and its CC headers are changed to private. Requests appear in the cache-cookies log channel.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Spike | BBlack | T117435 Spike: CentralNotice: Verify that our Special:HideBanners cookie storm works as efficiently as possible | ||
| Open | None | T257703 Clean up Cache-Control handling in MediaWiki | |||
| Open | Spike | None | T256447 Special:HideBanners is not really cacheable |
Event Timeline
Comment Actions
Thanks @tstarling! As it turns out, current and upcoming browser restrictions on third-party cookies are quickly making cross-site banner hiding unworkable.
The solution we're looking at for Fundraising is sending donors through a redirect on Wikipedia to set the cookie after they donate. So at least they'll get the donate hide cookie on the only site that shows fundraising banners.
As regards other types of banners, there is basically no cross-site banner hiding solution in sight. When users click to close a banner, they'll get a hide cookie for that campaign only on the site they saw the banner on.
(For logged-in users, however, there is a new feature in the works that will mitigate this somewhat: soon, they'll be able to set preferences to simply not see certain types of banners.)
Actually we'd really like to get some input on the Wikipedia redirect solution for donors. Please see T251780.
As regards this ticket, I think we need to first determine how long we'll leave the current cross-site cookie storm system in place. I guess it may not stay for long at all.
Thanks again!!
Comment Actions
The swap of Traffic for Traffic-Icebox in this ticket's set of tags was based on a bulk action for all such tickets that haven't been updated in 6 months or more. This does not imply any human judgement about the validity or importance of the task, and is simply the first step in a larger task cleanup effort. Further manual triage and/or requests for updates will happen this month for all such tickets. For more detail, have a look at the extended explanation on the main page of Traffic-Icebox . Thank you!