Hi there,
we are heavily relying on the Usercentrics v2 privacy extension for our websites.
Sometime in the last months, there has been an update to the extension, namely the introduction of a required domain filter for which the extension will be active.
We encountered two major issues with this:
1. The domain list is required instead of optional
As each of our websites gets its own profile, there is no need to have a required domain filter. We want the CMP (extension) to be active on ALL domains/sites using that profile. If you enter a wrong domain (for whatever reason, might be a simple mistake), or forget one, the CMP extension is disabled for the whole website using that profile! Which means, no blocking of tags by default. In case you need this filtering, this might make sense, but in our case this is a serious design flaw, as the default should be "block everything unless I tell you otherwise".
Suggestion: make the domain filter optional, so you can use it if you need to filter for domains in a profile.
2. The logic to check the current domain is flawed
According to your documentation , it should be enough to enter the domain names, e.g., "example.com". Which makes perfect sense.
Looking into the code of the extension, this is not true, though:
var domains = Object.keys(window.tealiumCmpIntegration.map);
var domainName = '';
for (var i = 0; i < domains.length; i++) {
var domain = domains[i];
var currentDomain = document.location.href.replace(/(^\w+:|^)\/\//, '');
domain.endsWith('/') ? (domain = domain.slice(0, -1)) : domain;
currentDomain.endsWith('/')
? (currentDomain = currentDomain.slice(0, -1))
: currentDomain;
if (domain === currentDomain) {
domainName = domain;
break;
}
}
if (!domainName) {
logger('No valid domain found. Tealium CMP integration inactive.');
isValidDomain = false;
return;
}As you can see, it uses "document.location.href" instead of "document.location.hostname". Because of that, I'd have to enter ALL paths for which the extensions should work, e.g., "example.com/path/", "example.com/path2" and so on. Is this the intended behaviour? I hope not, because that would take a huge effort to maintain.
Suggestion: use "doucment.location.hostname" to resolve the current domain.
Am I missing something here? At the moment the only way to "safely" use the extension (= the old behaviour), is to keep the domain filter empty and just dismiss the configuration error when publishing a profile. (edit: I just checked, it's worse than I expected: keeping the domain list empty will prevent the extension from being active, as "domainName" never gets populated if "domains" is empty.)
Cheers,
Eric
Expand/CollapseMenu
