Conversation
Restricts the Cookie header sent to Matomo to configured names/prefixes instead of forwarding all site cookies. Opt-in via $COOKIE_ALLOWLIST, unset preserves current behavior. Fixes #99.
Fail closed instead of open when $COOKIE_ALLOWLIST is misconfigured (non-array), document and test the '*'/'' no-op guard, trim cookie name/value around '=', and expand docs on cookie_name_prefix, matomo_ignore, and data-quality risks.
Use error_log() instead of trigger_error() so a misconfigured allowlist warning can never leak into the response body when display_errors is on. Trim allowlist entries for parity with the already-trimmed cookie name/value parsing, add a test for a stray empty entry among real ones, give matomo_ignore its own warning in the README, and de-duplicate/shorten the test-only config hooks and several overly long comments.
sgiehl
marked this pull request as ready for review
July 2, 2026 12:52
caddoo
approved these changes
Jul 3, 2026
caddoo
left a comment
caddoo
left a comment
Contributor
There was a problem hiding this comment.
Nice, tested locally and it works.
Happy that it's off by default.
Looks like the only risk is use error (bad configuration).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #99.
Adds an opt-in
$COOKIE_ALLOWLISTconfig array to restrict which cookies the proxy forwards to Matomo, instead of always forwarding the entireCookieheader. Entries ending in*prefix-match (for Matomo's suffixed cookies like_pk_id.1.1fff); plain entries match exactly. Unset preserves current behavior.