6

Is there a way to rename the Sitecore cookie SC_ANALYTICS_GLOBAL_COOKIE? Wappalyzer identifies a Sitecore site via this cookie, and we would like to stop it from doing so, whilst retaining the behaviour associated with the cookie.

  • 1
    +1 for getting this info out there! This is something that I have wanted to see Sitecore improve for quite a while now – Zachary Kniebel Nov 23 '16 at 16:57
  • 1
    This really should a configuration option. I have created a suggestion on sitecorecommunity.uservoice.com/forums/… - please upvote this, so we can bring focus to this issue. – Sune Rievers Dec 6 '16 at 13:11
12

With no obvious way of making Sitecore do our bidding, and me not finding any IIS configuration way of achieving this - I opt for a third solution. Enter a HttpModule to achieve this.

Function is fairly simple. Outgoing, any SC_ANALYTICS_GLOBAL_COOKIE will get removed and our own MY_COOKIE added, with the same value. Ingoing, any incoming MY_COOKIE will result in a SC_ANALYTICS_GLOBAL_COOKIE getting added.

Code looks like this:

namespace Website.CookieRenamer
{
    public class CookieRenamerModule : IHttpModule
    {
        public void Init(HttpApplication context)
        {
            context.BeginRequest += Context_BeginRequest;
            context.PostRequestHandlerExecute += Context_PostRequestHandlerExecute;
        }

        public void Dispose()
        {
        }

        private void Context_BeginRequest(object sender, EventArgs e)
        {
            var application = (HttpApplication) sender;
            var context = application.Context;
            var trackingCookie = context.Request.Cookies["MY_COOKIE"];
            if (trackingCookie != null)
                WebUtil.SetCookieValue("SC_ANALYTICS_GLOBAL_COOKIE", trackingCookie.Value);
        }

        private void Context_PostRequestHandlerExecute(object sender, EventArgs e)
        {
            var application = (HttpApplication) sender;
            var context = application.Context;
            var trackingCookie = context.Response.Cookies["SC_ANALYTICS_GLOBAL_COOKIE"];
            if (trackingCookie != null)
            {
                WebUtil.SetCookieValue("MY_COOKIE", trackingCookie.Value);
                context.Response.Cookies.Remove("SC_ANALYTICS_GLOBAL_COOKIE");
            }
        }
    }
}

It gets configured in the <system.webServer> section of Web.config like this:

<add type="Website.CookieRenamer.CookieRenamerModule, Website" name="CookieRenamer" />

And the desired end result comes out like this. Rename cookie as appropriate.

enter image description here

  • Sneaky solution ;-) – Dražen Janjiček Nov 24 '16 at 13:37
  • 2
    I believe it's called "thinking outside the box" ;-) – Mark Cassidy Nov 24 '16 at 13:41
  • As a tiny remark, I would use the constant that Sitecore provides for the cookie name instead of hard-coding the same. – Dražen Janjiček Nov 24 '16 at 13:43
  • 1
    Yea. Would involve trying to reflect a private const though. Not sure how I would approach that. Besides, when the Sitecore cookie is no longer hardcoded, this code becomes redundant :-) – Mark Cassidy Nov 24 '16 at 13:44
  • 1
    Not 100% sure. I placed it last. I had to fiddle quite a bit to begin with - I tried "rewriting" the incoming/outgoing cookie. That doesn't work for a long list of complicated IIS reasons. Eventually I settled on this solution, as it ticks the boxes. – Mark Cassidy Nov 24 '16 at 16:05
4

Unfortunately, there is not a way to do this. Have a look at the Sitecore.Analytics.Web.ContactKeyCookie class. You will find the following constant there:

private const string AnalyticsGlobalCookieName = "SC_ANALYTICS_GLOBAL_COOKIE";

The above means that the cookie name is hard-coded into Sitecore and cannot be changed.

In addition to the above, note also that this text is also hard-coded in all of the following locations (excluding locations where the constant is used) in the assemblies included natively in Sitecore 8.1u2:

enter image description here

My thoughts

IMHO, this is something that should be changed in the Sitecore code-base, as security could be improved by changing the cookie name in a way that prevents people from seeing that the site is a Sitecore site (which I assume is the reason why you want to do this).

Next Steps

I recommend that you file a Sitecore Support ticket for this issue. At least put it on their radar and explain the security hardening benefits to the system if they include support for this. They may give you a patch, and may even add this change to a future release.

  • There's a couple of user voice sites which you could submit this to? Not sure which would be most likely to be seen by the right people at Sitecore: see the top 3 results of this search: google.co.uk/… – Owen Niblock Nov 24 '16 at 9:45
  • 1
    @OwenNiblock: sitecorecommunity.uservoice.com is the official Sitecore UserVoice site to use. – jammykam Nov 24 '16 at 15:03
  • Nice - I'll do that! – Zachary Kniebel Nov 24 '16 at 15:08
2

I don't think this is possible without custom code. The string appears hardcoded twice in sitecore libraries.

Sitecore.Analytics.dll

namespace Sitecore.Analytics.Web
{
  public class ContactKeyCookie
  {
    private const string AnalyticsGlobalCookieName = "SC_ANALYTICS_GLOBAL_COOKIE";
    .....
    .....
  }      
}  
  • just a note, decompiled constants show up as hard coded strings. it's probably only hardcoded once, defining the constant. – Pete Navarra Nov 24 '16 at 4:50
  • Yeap, you are right Pete. Will remove second reference. – josedbaez Nov 24 '16 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.