| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // http://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| // |
| === How profile tracking works |
| |
| In this section you will learn how Apache Unomi keeps track of visitors. |
| |
| ==== Steps |
| |
| 1. A visitor comes to a website |
| 2. The web server resolves a previous request session ID if it exists, or if it doesn't it create a new sessionID |
| 3. A request to Apache Unomi's /cxs/context.json servlet is made passing the web server session ID as a query parameter |
| 4. Unomi uses the sessionID and tries to load an existing session, if none is found a new session is created with the |
| ID passed by the web server |
| 5. If a session was found, the profile ID is extracted from the session and if it not found, Unomi looks for a cookie |
| called `context-profile-id` to read the profileID. If no profileID is found or if the session didn't exist, a new |
| profile ID is created by Apache Unomi |
| 6. If the profile ID existed, the corresponding profile is loaded by Apache Unomi, otherwise a new profile is created |
| 7. If events were passed along with the request to the context.json endpoint, they are processed against the profile |
| 8. The updated profile is sent back as a response to the context.json request. Along with the response |
| |
| It is important to note that the profileID is always server-generated. Injecting a custom cookie with a non-valid |
| profile ID will result in failure to load the profile. Profile ID are UUIDs, which make them (pretty) safe from brute- |
| forcing. |
