search

usefathom / fathom

Fathom Lite. Simple, privacy-focused website analytics. Built with Golang & Preact.
https://usefathom.com/
MIT License
7.55k stars 368 forks source link

Pro version Same Site cookies. #296

Closed xtrasmal closed 4 years ago

xtrasmal commented 4 years ago

A site with the pro version shows this in the browser console:

A cookie associated with a cross-site resource at http://app.usefathom.com/ was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

Observations which I'd like to have some information on if that is possible:

arielsalminen commented 4 years ago

Just ran into this same error with the paid version and wondering the exact same questions as above. Using the latest Chrome version.

Edit: This issue seems to be only happening to those users who have previously visited app.usephantom.com. I wonder if this will cause issues in future Chrome releases though based on the message:

Screen Shot 2019-11-04 at 20 07 51
arielsalminen commented 4 years ago

Update: I’ve been investigating this with the Fathom team and we now found out that the issue is caused by Stripe’s cookies on Fathom’s own website. Stripe is aware of this issue, but they haven’t fixed it yet.

A thing to also note that this issue only happens for users who have previously visited http://app.usefathom.com/ where Stripe’s cookie are set.

So to answer some of @xtrasmal questions:

— No, Fathom does not set cookies. Its own website uses Stripe’s cookies which causes some users to see this if they open console on another website that uses Fathom, enable “all levels” and hit Command+Shift+R/Ctrl+Shift+R. — They’ve now added SameSite attributes, but as it’s apparently Stripe’s cookies that cause this, it does not fix the issue. — Not sure about the http part, Fathom folks should answer that for you.

JackEllis commented 4 years ago

Thanks @viljamis, appreciate your reply!

We've now moved the Stripe code to the billing section with the app, so visiting https://app.usefathom.com alone will not trigger it.