Why is Goodreads connecting to Google when I visit their website?

Question

I was browsing Goodreads.com with uBlock origin installed on my browser. I'm not a web developer but, I understand that some websites send requests to "ajax.googleapis.com" in order to design their UI. This website (security.stackexchange.com) does it too.

From the above screenshot, it's clear that ajax google APIs were used without sending a request to google.com on this page. So, I conclude that

Using ajax google APIs doesn't require the website to send a request to "google.com".

Green on the left side of uBlock origin panel means that requests were sent to these domains while visiting this page and thus those domains know about your presence on this website. Red represents that an attempt to was made to reach the domain but, it was blocked.

That being said, when I visited the stat page of Goodreads, I couldn't load the graph.

So, to fix it, I started unblocking the requested domains one at a time. When I unblocked "google.com", I noticed that requests were made to Google's Ajax APIs only after I unblock the request to "google.com".

This made me wonder why have the designers of this website programmed it that way it is? Why didn't they called Ajax APIs directly? The only reason I could think of is that it's a way of enforcing users to disclose their presence to Google. But, I'm open to the idea that I might be wrong. Could someone provide a technical clarification to what's happening here?

Is Goodreads letting Google know of my presence on their website?

EDIT: Sorry to use the term "Selling" I don't want to get political. Just looking for a technical explanation to this scenario and want to know if there's a possibility that there's a reason to sending requests to google.com other than letting Google know of my presence.

Answer 1

This is not really a question about security, however I understand that people may be confused by the way things are usually implemented on websites. What happens depends entirely on the order in which assets are loaded in the page.

First your plugin blocks all the scripts. The plugin will only show you the external scripts that can be found in the page, which are blocked. Then, when you allow those scripts, those scripts will execute and in turn they might load other scripts, which will be blocked again by the plugin. If you allow these scripts again, they will execute and they might load yet other scripts, and so on. That's why you sometimes have to keep allowing scripts, and more will appear.

Your page (note: registration is required): https://www.goodreads.com/review/pub_year_graph/37991099

In that page you have this code:

<script type="text/javascript" src="//www.google.com/jsapi"></script>

That script contains the following line, along with a lot of other code:

google.loader.GoogleApisBase = 'https://ajax.googleapis.com/ajax';

So first the page loads a script from google.com, and that script in turn loads other javascript from ajax.googleapis.com. Why do scripts load other scripts from other domains, instead of just loading what is needed from one domain? It's usually just the way they organize their APIs and services, and it might make sense because you can manage everything easily from one API, instead of having to worry about several different scripts and domains.

But if you are asking why they didn't place the script on the googleapis.com domain, and instead they loaded it from google.com, and so your browser ended up sending your google.com cookies along with the request, then I don't have an answer. Users' data is Google's business, so that choice might well have been on purpose. I don't know, I guess it would be interesting to ask Google why, maybe there's a technical reason, or maybe not. However, if you are in Europe, Google is not really at fault here. GDPR (General Data Protection Regulation, European law on privacy) requires that the websites check what they are doing with their users' data. So it's technically goodreads.com that is at fault here, for using Google's services in that way, no matter if they have a choice or not. In practice though nobody cares about Google, data, privacy or any laws about privacy. For now, at least.