[MGNLPN-507] Consider an in-memory ip-based cache as an alternative to session storage for geo ip information Created: 15/Oct/20  Updated: 02/Nov/21  Resolved: 11/Mar/21

Status: Closed
Project: Magnolia Personalization
Component/s: None
Affects Version/s: None
Fix Version/s: None

Type: Task Priority: Neutral
Reporter: Aleksandr Pchelintcev Assignee: Unassigned
Resolution: Won't Do Votes: 0
Labels: maintenance
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Relates
relates to MAGNOLIA-7896 Generation of CSRF token is too expen... Closed
supersession
is superseded by MGNLPN-512 Reduce the scope of CountryDetectorFi... Open
Template:
Acceptance criteria:
Empty
Task DoR:
Empty
Date of First Response:
Epic Link: Security

 Description   

The side effect of info.magnolia.personalization.geoip.CountryDetectorFilter currently is that it triggers the session creation for even anonymous users. This is done supposedly to not invoke costly GeoIp calls upon every request, but is prone to various problems related to the anonymous user sessions:

  • e.g. as had suggested - it could be prone to denial of service attacks
  • it masquerades our CSRF-prevention mechanism (which kicks in only when the session is not created)


 Comments   
Comment by Jan Haderka [ 15/Oct/20 ]

Also raises GDPR concerns regarding the data being stored about anonymous users and possibly not mentioned in the privacy statement which clients don't know how to answer.

Comment by Roman Kovařík [ 15/Oct/20 ]

This is done supposedly to not invoke costly GeoIp calls upon every request

Session scoped traits were introduce mainly because of traits resolved by calls to 3th party systems.
Country trait was just a showcase of feature but not really a performance concern and can be a request scope trait again.

Generated at Mon Feb 12 06:38:19 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.