Rename SC_ANALYTICS_GLOBAL_COOKIE

Question

Is there a way to rename the Sitecore cookie SC_ANALYTICS_GLOBAL_COOKIE? Wappalyzer identifies a Sitecore site via this cookie, and we would like to stop it from doing so, whilst retaining the behaviour associated with the cookie.

Answer 1

With no obvious way of making Sitecore do our bidding, and me not finding any IIS configuration way of achieving this - I opt for a third solution. Enter a HttpModule to achieve this.

Function is fairly simple. Outgoing, any SC_ANALYTICS_GLOBAL_COOKIE will get removed and our own MY_COOKIE added, with the same value. Ingoing, any incoming MY_COOKIE will result in a SC_ANALYTICS_GLOBAL_COOKIE getting added.

Code looks like this:

namespace Website.CookieRenamer
{
    public class CookieRenamerModule : IHttpModule
    {
        public void Init(HttpApplication context)
        {
            context.BeginRequest += Context_BeginRequest;
            context.PostRequestHandlerExecute += Context_PostRequestHandlerExecute;
        }

        public void Dispose()
        {
        }

        private void Context_BeginRequest(object sender, EventArgs e)
        {
            var application = (HttpApplication) sender;
            var context = application.Context;
            var trackingCookie = context.Request.Cookies["MY_COOKIE"];
            if (trackingCookie != null)
                WebUtil.SetCookieValue("SC_ANALYTICS_GLOBAL_COOKIE", trackingCookie.Value);
        }

        private void Context_PostRequestHandlerExecute(object sender, EventArgs e)
        {
            var application = (HttpApplication) sender;
            var context = application.Context;
            var trackingCookie = context.Response.Cookies["SC_ANALYTICS_GLOBAL_COOKIE"];
            if (trackingCookie != null)
            {
                WebUtil.SetCookieValue("MY_COOKIE", trackingCookie.Value);
                context.Response.Cookies.Remove("SC_ANALYTICS_GLOBAL_COOKIE");
            }
        }
    }
}

It gets configured in the <system.webServer> section of Web.config like this:

<add type="Website.CookieRenamer.CookieRenamerModule, Website" name="CookieRenamer" />

And the desired end result comes out like this. Rename cookie as appropriate.

Answer 2

Unfortunately, there is not a way to do this. Have a look at the Sitecore.Analytics.Web.ContactKeyCookie class. You will find the following constant there:

private const string AnalyticsGlobalCookieName = "SC_ANALYTICS_GLOBAL_COOKIE";

The above means that the cookie name is hard-coded into Sitecore and cannot be changed.

In addition to the above, note also that this text is also hard-coded in all of the following locations (excluding locations where the constant is used) in the assemblies included natively in Sitecore 8.1u2:

My thoughts

IMHO, this is something that should be changed in the Sitecore code-base, as security could be improved by changing the cookie name in a way that prevents people from seeing that the site is a Sitecore site (which I assume is the reason why you want to do this).

Next Steps

I recommend that you file a Sitecore Support ticket for this issue. At least put it on their radar and explain the security hardening benefits to the system if they include support for this. They may give you a patch, and may even add this change to a future release.

Answer 3

I don't think this is possible without custom code. The string appears hardcoded twice in sitecore libraries.

Sitecore.Analytics.dll

namespace Sitecore.Analytics.Web
{
  public class ContactKeyCookie
  {
    private const string AnalyticsGlobalCookieName = "SC_ANALYTICS_GLOBAL_COOKIE";
    .....
    .....
  }      
}