We have been asked to evaluate Conversant Tracking.


From what I can tell its pretty straight forward tracking, like google re-marketing, you pass them the information you want to via some javascript, and they target your visitors with targeted ads you have set up.

The main issue I have is they require us to point two cnames at their system to allow for "First Party Cookies".

I know this means all cookies would have to be changed to www.foobar.com, instead of foobar.com, to avoid any issues with information being possible exposed to their end.

But more I was wondering what type of attacks this could open us up to if they had a security issue, if this is more or less secure than google's re-marketings model, and what issues could this cause for us with PCI compliance?

PS We use Braintree and Braintree.js so we are just covered under PCI for handling of Tokens, if that matters at all.

1 Answer 1


Cookies that are used to maintain session state must have a limited scope.

Using JavaScript track users by their session id, means you can't use the httpOnly cookie flag. Scoping cookies to *.foobar.com means that XSS on *.foobar.com could compromise this cookie value. Or to put this another way, if a session id is scoped to *.foobar.com and doesn't have the httpOnly flag, then every domain on *.foobar.com is permitted to compromise a session using XSS. In the context of PCI compliance, this specific design would greatly expand the attack surface that needs to be regularly validated.

One solution is to use another randomly generated token for the purposes of tracking users, and then protect the authenticated session id as a separate cookie value.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .