Repository navigation
Conversation
ChristianPavilonis
left a comment
ChristianPavilonis
left a comment
There was a problem hiding this comment.
Approved. Restricts Prebid Server cookie forwarding to consent signals, with signal-specific JSON fallback while preserving the full consent context for enforcement.
dhruv8sh
left a comment
dhruv8sh
left a comment
There was a problem hiding this comment.
Summary
This PR stops sending the browser's whole Cookie header to Prebid Server (PBS). In both and cookies_only mode, PBS gets only the four consent cookies; in openrtb_only, it gets no Cookie header at all. When a consent cookie can't be forwarded safely in cookies_only mode, just that one signal is sent in the OpenRTB body instead. The cookie parsing is the same as consent extraction's, so the two always pick the same values. This meets every acceptance criterion in #763. Tests run through the real request path and cover every mode, both consent sources, and the malformed-input cases. The outbound-cookie audit in the docs is a useful addition.
None of the inline comments below carries a one-click
suggestion. Each fix is described in prose because it changes more than a single contiguous line range.
Non-blocking
🤔 thinking / ♻️ refactor
- An unreadable
Cookieheader turns off the body fallback incookies_only: see inline atcrates/trusted-server-core/src/integrations/prebid.rs:2118 - A panic on the request path if
CONSENT_COOKIE_NAMESgrows: see inline atcrates/trusted-server-core/src/integrations/prebid.rs:2134
👍 praise
- Tests go through the real request path for each consent signal: see inline at
crates/trusted-server-core/src/auction/orchestrator.rs:6460
CI Status
All checks pass.
Retain existing consent through the JSON fallback when the Cookie header cannot be read. Replace the future allowlist mismatch panic with a warning and conservative fallback.
aram356
left a comment
aram356
left a comment
There was a problem hiding this comment.
Summary
This PR limits the PBS Cookie header to the four consent cookies (and sends none in openrtb_only), and adds a per-signal JSON fallback for unsafe values in cookies_only. The routed production path builds the body fallback and the header from the same transport snapshot, and the header-byte tests are thorough. Three things need changes before merge. The CHANGELOG should mark the PBS uids/host-cookie loss as breaking. The GDPR applicability carried by a partial fallback has no test (four mutations survive the full core suite). And the new audit page misstates where EC IDs travel.
6 of the inline comments below carry a one-click GitHub
suggestion. Use Commit suggestion, or Add suggestion to batch for several at once, to apply them as commits on the PR branch. The remaining comments describe the fix in prose because it touches lines outside the diff or more than one file. Each suggestion was applied alone toc7b89e8and verified: the Rust ones with rustfmt, all six clippy aliases, all four adapter test aliases, and parity; the Markdown ones with the pinned prettier. All six applied together also pass rustfmt,clippy-fastly, and the native core suite.
Blocking
🔧 wrench
- Flag the PBS
uids/host-cookie loss as Breaking: see inline atCHANGELOG.md:31 - Pin the GDPR applicability of a partial fallback (4 surviving mutations): see inline at
crates/trusted-server-core/src/integrations/prebid.rs:10094 - Audit page misstates EC ID sources,
forward_ec_id, and omits pull sync: see inline atdocs/guide/integrations/cookie-forwarding.md:58 - Delete the now-unused
strips_consent_cookies(): see inline atcrates/trusted-server-core/src/consent_config.rs:134 - Filter the cookie in the transport snapshot instead of at each reader: see inline at
crates/trusted-server-core/src/auction/routing.rs:208 - Add the audit page to the docs sidebar: see inline at
docs/guide/integrations/cookie-forwarding.md:1 - Proxy row describes header sets imprecisely: see inline at
docs/guide/integrations/cookie-forwarding.md:49 CookiesLenis the selected header's length, not a total: see inline atdocs/guide/integrations/cookie-forwarding.md:84- Split the shadowed
let … elseinfrom_header: see inline atcrates/trusted-server-core/src/integrations/prebid.rs:2118
Non-blocking
📌 out of scope
cookies_onlygives a standard PBS no usable consent: see inline atcrates/trusted-server-core/src/consent_config.rs:136
CI Status
- .github/dependabot.yml: PASS
- Analyze (actions): PASS
- Analyze (javascript-typescript): PASS (2 runs)
- Analyze (python): PASS
- Analyze (rust): PASS
- browser integration tests: PASS
- cargo check (cloudflare native + wasm32-unknown-unknown): PASS
- cargo check/build/test (spin native + wasm32-wasip1): PASS
- cargo fmt: PASS (required)
- cargo test: PASS (required)
- cargo test (axum native): PASS
- cargo test (cross-adapter parity): PASS
- cargo test (ts CLI, native) (macos-latest): PASS
- cargo test (ts CLI, native) (ubuntu-latest): PASS
- CI Node pin guard: PASS
- CLAUDE.md symlink guard: PASS
- CodeQL: PASS
- docs-proposal scripts: PASS
- format-docs: PASS (required)
- format-typescript: PASS (required)
- HTML EOF runtime (Fastly): PASS
- integration tests: PASS
- integration tests (Fastly EC lifecycle): PASS
- prepare integration artifacts: PASS
- ts dev lint domains (changed lines): PASS
- vitest: PASS
Store the consent-cookie selection in PrebidTransportHeaders instead of the raw browser Cookie header, so publisher session and identity cookies are never retained for the auction and both readers share one parse. Pin the GDPR applicability carried by a partial cookies_only fallback, remove the unused strips_consent_cookies helper, and split the shadowed let-else in PrebidConsentCookies::from_header. Correct the cookie-forwarding audit (EC ID sources, forward_ec_id, pull sync, proxy header sets, CookiesLen), add it to the docs sidebar, update the architecture spec snapshot contract, and flag the PBS uids/host-cookie loss as breaking in the CHANGELOG.
Summary
Cookieheaders toeuconsent-v2,__gpp,__gpp_sid, andus_privacy; omit the header inopenrtb_only.cookies_only, body fallback includes only the affected signal; GPP and section IDs travel together. Original consent gating and identity decisions use the unchanged complete context.Changes
crates/trusted-server-core/src/integrations/prebid.rscrates/trusted-server-core/src/auction/{openrtb,orchestrator}.rscrates/trusted-server-core/src/cookies.rsCloses
Closes #763
Spec
Not a feature. The issue specifies the policy. Technical plan:
docs/superpowers/plans/2026-10-22-prebid-consent-cookie-allowlist.md.Behavior decisions and review
A consent signal that cannot be safely framed as a cookie falls back to its JSON representation in
cookies_only; unrelated safe signals stay cookie-only. GPP string and section IDs are one coupled signal, with required GDPR applicability metadata. Policy-sourced consent retains its existing body behavior. Unsafe raw bytes never bypass the header filter.Production-path regressions cover unsafe
euconsent-v2, GPP section IDs, and US Privacy values alongside safe unrelated signals. The regression first failed with the broad fallback, then passed with selective fallback. Fresh independent cookie and cross-PR reviews found no remaining actionable correctness issues.Compatibility limitation: a receiving service must consume consent cookies for safe
cookies_onlysignals. The standard PBS auction documentation specifies OpenRTB consent fields; it does not establish support for these four incoming consent cookies. This existing mode's compatibility with particular PBS deployments was not validated here. This PR preserves the mode rather than silently changing all safe consent to body forwarding.Test plan
Exploratory
tsc --noEmitand whole-repositoryactionlintreport pre-existing errors in unchanged files; they are not counted as passing checks. The changed workflows in #1433 pass scoped lint. Local verification uses Rust 1.98.1, Viceroy 0.21.0, and Node 24.12.0; the repository pins Node 24.20.0. No live PBS/browser validation was performed.Checklist