Cross Domain User Tracking

Question

We have several websites on different domains and I'd like to be able to track users' movements on these sites.

• Obviously cookies are not feasable, because they don't cross domain borders.
• I could look at a combination of IP address and User Agent, but there are some cases where that does not work.
• I don't want to use flash or other plugins.

Any ideas? Or am I doomed to rely on the IP/User_Agent combination?

Answer 1

This solution requires no JavaScript, and works even if the user disables third-party cookies.

First, let's make sure the user agent is sending cookies:

If getCookie("c") == null then setCookie("c", "anyValue")

Then let the request finish (aka wait for next request)

Let's call our tracker cookie uaid.

If GET http://child.com/any-page and getCookie("c") is not null and getCookie("uaid") is null...

Redirect to http://parent.com/give-me-a-uaid?returnTo=http://child.com/any-page

On http://parent.com/give-me-a-uaid, check for cookie uaid

If not exists, create it and add it to response. If it exists, get its value.

Redirect to http://child.com/any-page?uaid=valueOfParentsUAIDCookie

Child.com sets cookie uaid with valueOfParentsUAIDCookie

Redirect to http://child.com/any-page

And of course, you are validating input, and white-listing your redirect URLs :)

Flows:

Answer 2

You do not give any context to your situation -just the basic problem. So it is difficult to give an answer that clearly fits. However, here are some techniques/mechanisms for passing information from one page to another, regardless of what domain is involved.

• include hyperlink to a 1x1 pixel transparent gif image (sometimes called a "beacon")
• rely on referrer information in HTTP request headers to identify page hyperlink is on
• include extra parameters in hyperlinks to other site - assuming you run both sites
• buy services of a company like Akamai to do user tracking for you
• possibly use cross domain cookie mechanism in the future if standard is ever approved

Which techniques really come down to whether you can place software on all of the sites (servers) that the user will visit where you have interest - or you cannot place your software on all of them.

Answer 3

You can follow the same concept used in Google Analytics. Injecting javascript in the pages you want to track.

Answer 4

This question is closely related to the Question Accessing Domain Cookies within an iFrame on Internet Explorer.

For Internet Explorer I need to take P3P Policies into account and set an additional P3P HTTP-Header to allow images to set cookies across domain borders. Then I can use simon's suggestion.

Answer 5

You can designate one domain or subdomain to tracking and have it serve a 1x1 pixel image which you include in all pages you would like to track. Serve a cookie with the image, look at the tracking domain's server logs, voilà.