Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Tracking API: fail with an error when wrong authentication provided when sending custom ip address (instead of using the sender's ip address) #13471

Closed
mattab opened this issue Sep 23, 2018 · 7 comments · Fixed by #13675 or #15888
Closed

Tracking API: fail with an error when wrong authentication provided when sending custom ip address (instead of using the sender's ip address) #13471

mattab opened this issue Sep 23, 2018 · 7 comments · Fixed by #13675 or #15888
Assignees
@sgiehl
Labels
RFC Indicates the issue is a request for comments where the author is looking for feedback.
Milestone
4.0.0

Comments

@mattab
Copy link
Member

mattab commented Sep 23, 2018

A token_auth can be invalid when, for example:

  • The user has re-generated a new token_auth in the personal settings, and forgot to update the token in the SDK
  • The wrong token is used
  • The user whose token was used has been deleted
  • An attacker is trying to guess valid tokens

When a token_auth is invalid, some API features (which are usually essential for SDK users who can't use the JS tracker) won't work well:

  • Setting custom IP address
  • Setting custom date and time
  • Overriding the default geolocation

We have two choices when it comes with dealing with these requests that have an invalid token_auth:

  1. track them as if there was no token specified (possibly tracking a wrong IP address, or a wrong custom date & time) - this is current behavior
  2. drop them entirely

-> What do you think?

Personally I'm not sure what is the best solution. If we decide to go with 2) we should make sure that, the requests are not dropped, when the token_auth was invalid AND there was no parameter in the request that need token_auth, ie. nocip, cdt, country, city, region.... (these requests with and without a valid token, would have the exact same behavior).
@mattab mattab added the RFC Indicates the issue is a request for comments where the author is looking for feedback. label Sep 23, 2018
@mattab mattab added this to the 3.7.0 milestone Sep 23, 2018
@mattab mattab mentioned this issue Sep 23, 2018
Closed
@tsteur
Copy link
Member

tsteur commented Sep 23, 2018 •
edited

FYI: I used https://demo.matomo.org/piwik.php?idsite=1&rec=1&cdt=1388540582&token_auth=1234
=> results in an error HTTP 400.
What request did you use?

@tsteur
Copy link
Member

tsteur commented Sep 24, 2018

IMO any such tracking request with invalid token should not be tracked. Worse than not tracking is only tracking of wrong data and it is not even trivial to find out and to get a chance to see that the token is eg invalid.

@mattab
Copy link
Member Author

mattab commented Sep 24, 2018

I was using https://demo.matomo.org/piwik.php?idsite=1&rec=1&cip=1.1.1.1&token_auth=1234 which returns 200

@tsteur
Copy link
Member

tsteur commented Sep 24, 2018

Yeah I can see in code cip falls back to header, cid throws exception. IMO both should throw an exception.

@mattab
Copy link
Member Author

mattab commented Oct 8, 2018

Sounds good to have both throw an exception, be consistent.

@tsteur tsteur self-assigned this Nov 6, 2018
@tsteur tsteur mentioned this issue Nov 6, 2018
Merged
@diosmosis
Copy link
Member

Not fixed after revert, rescheduling for 4.0

@diosmosis diosmosis reopened this Dec 14, 2018
@diosmosis diosmosis modified the milestones: 3.8.0, 4.0.0 Dec 14, 2018
@diosmosis
Copy link
Member

Note: will need to change the php tracker when this is merged, since it will send cip by default.

@tsteur tsteur removed their assignment Mar 20, 2020
@sgiehl sgiehl self-assigned this Apr 30, 2020
@sgiehl sgiehl mentioned this issue Apr 30, 2020
Merged
@mattab mattab changed the title Tracking API: when an invalid token_auth is specified, should the request be entirely dropped, or tracked anyway? Tracking API: fail with an error when wrong authentication provided when sending custom ip address (instead of using the sender's ip address) Sep 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sgiehl sgiehl

Labels
RFC Indicates the issue is a request for comments where the author is looking for feedback.
Projects
None yet
Milestone
4.0.0
4 participants
@diosmosis @tsteur @mattab @sgiehl