Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add option to track only POST requests #18784

Open
daniel-lerch opened this issue Feb 12, 2022 · 5 comments
Open

Add option to track only POST requests #18784

daniel-lerch opened this issue Feb 12, 2022 · 5 comments
Labels
Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.
Milestone
For Prioritization

Comments

@daniel-lerch
Copy link

I would like to have an option for Matomo only to count tracking requests send as POST.

Summary

The official HTTP standard specifies GET requests as safe. However, GET requests to the Matomo tracking API actually change the server state. The suitable request for this case is POST.

Surely there are many use cases for tracking where GET requests are absolutely necessary but especially for mobile apps it would be better to count only post requests to prevent counting bot visitors by virus scanners, etc. All websites which use the JavaScript tracker could also enable this restriction.

The option track only POST requests should be per site and Matomo could either return 200 OK and do nothing or return 405 Method Not Allowed when it receives a GET request to the tracking API.

Your Environment

  • Matomo Version: 4.7.1
  • PHP Version: 8.0.15
  • Server Operating System: Docker
  • Additionally installed plugins: MobileAppMeasurable
@daniel-lerch daniel-lerch added the Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. label Feb 12, 2022
@bx80
Copy link
Contributor

bx80 commented Feb 13, 2022

Hi @daniel-lerch, thanks for contacting us.

There is an option available for the javascript tracker called setRequestMethod which will only send tracking requests as type POST. This can be added to the tracking code per site with _paq.push(["setRequestMethod", "POST"]); This should provide the behaviour you need, but if not let us know 🙂

@bx80 bx80 closed this as completed Feb 13, 2022
@bx80 bx80 added answered For when a question was asked and we referred to forum or answered it. and removed Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. labels Feb 13, 2022
@daniel-lerch
Copy link
Author

@bx80 I actually thought about a server sided option which marks all GET requests as Bots and does not count them. If you do not want such an option to be added to Matomo, I will try to achieve that via NGINX configuration.

@sgiehl
Copy link
Member

sgiehl commented Feb 14, 2022

@daniel-lerch There are actually also downsides of using post requests only. Post won't contain the data when logged in the access log, which makes it impossible to replay the tracking if that would ever be required.
Nevertheless I agree that in some cases it might make sense to restrict the tracking to POST only.
I'm not sure if we will be adding that to Matomo core. Nevertheless it should be possible to implement that using a custom plugin.
I'll reopen the issue, so we can see if maybe more people would be interested in that.

@sgiehl sgiehl added Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc. and removed answered For when a question was asked and we referred to forum or answered it. labels Feb 14, 2022
@sgiehl sgiehl reopened this Feb 14, 2022
@daniel-lerch
Copy link
Author

@sgiehl Logging is an important concern but as far as I understand Matomo's tracking API POST requests do not contain data in their request body as it is sent as query string like:

POST /matomo.php?idsite=1&rec=1&url=https%3A%2F%2Fexample.com HTTP/1.1
Content-Length: 0
...

In this case logs would contain all data and could be replayed. Is there another mode accepting form encoded data or JSON via POST that I am not aware of?

@sgiehl
Copy link
Member

sgiehl commented Feb 14, 2022

Actually there is both. You can send the tracking parameters as form encoded data or in case of bulk tracking it's send as json.
Both might be done by the javascript tracker.

@sgiehl sgiehl added this to the For Prioritization milestone Jun 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.
Projects
None yet
Milestone
For Prioritization
Development

No branches or pull requests
3 participants
@sgiehl @daniel-lerch @bx80