c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<?xml version="1.0"?>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<!DOCTYPE modulesynopsis SYSTEM "/style/modulesynopsis.dtd">

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<?xml-stylesheet type="text/xsl" href="/style/manual.en.xsl"?>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<modulesynopsis metafile="mod_usertrack.xml.meta">

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<name>mod_usertrack</name>

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington<description>

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington<em>Clickstream</em> logging of user activity on a site

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts</description>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<status>Extension</status>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<sourcefile>mod_usertrack.c</sourcefile>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<identifier>usertrack_module</identifier>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<summary>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts <p>Previous releases of Apache have included a module which

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts generates a 'clickstream' log of user activity on a site using

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts cookies. This was called the "cookies" module, mod_cookies. In

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts Apache 1.2 and later this module has been renamed the "user

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts tracking" module, mod_usertrack. This module has been

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts simplified and new directives added.</p>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts</summary>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington<section id="logging">

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington<title>Logging</title>

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington <p>Previously, the cookies module (now the user tracking

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington module) did its own logging, using the <directive>CookieLog</directive>

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington directive. In this release, this module does no logging at all.

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington Instead, a configurable log format file should be used to log

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington user click-streams. This is possible because the logging module

a093731116a8c24d49b903df7602cf586e499b45Phill Cunnington now allows multiple log files. The cookie itself is logged by

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts using the text <code>%{cookie}n</code> in the log file format. For

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts example:</p>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts<example>

c0202e5a338212ae386c672821f6dc4931c50f45James PhillpottsCustomLog logs/clickstream "%{cookie}n %r %t"

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts</example>

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts <p>For backward compatibility the configurable log module

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts implements the old <directive

c0202e5a338212ae386c672821f6dc4931c50f45James Phillpotts module="mod_log_config">CookieLog</directive> directive, but this

should be upgraded to the above <directive

module="mod_log_config">CustomLog</directive> directive. </p>

</section>

<section id="cookiedate">

<title>2-digit or 4-digit dates for cookies?</title>

<p>(the following is from message

&lt;022701bda43d$9d32bbb0$1201a8c0@christian.office.sane.com&gt;

in the new-httpd archives) </p>

<pre>

From: "Christian Allen" &lt;christian@sane.com&gt;

Subject: Re: Apache Y2K bug in mod_usertrack.c

Date: Tue, 30 Jun 1998 11:41:56 -0400

Did some work with cookies and dug up some info that might be useful.

True, Netscape claims that the correct format NOW is four digit dates, and

four digit dates do in fact work... for Netscape 4.x (Communicator), that

is. However, 3.x and below do NOT accept them. It seems that Netscape

originally had a 2-digit standard, and then with all of the Y2K hype and

probably a few complaints, changed to a four digit date for Communicator.

Fortunately, 4.x also understands the 2-digit format, and so the best way to

ensure that your expiration date is legible to the client's browser is to

use 2-digit dates.

However, this does not limit expiration dates to the year 2000; if you use

an expiration year of "13", for example, it is interpreted as 2013, NOT

1913! In fact, you can use an expiration year of up to "37", and it will be

understood as "2037" by both MSIE and Netscape versions 3.x and up (not sure

about versions previous to those). Not sure why Netscape used that

particular year as its cut-off point, but my guess is that it was in respect

to UNIX's 2038 problem. Netscape/MSIE 4.x seem to be able to understand

2-digit years beyond that, at least until "50" for sure (I think they

understand up until about "70", but not for sure).

Summary: Mozilla 3.x and up understands two digit dates up until "37"

(2037). Mozilla 4.x understands up until at least "50" (2050) in 2-digit

form, but also understands 4-digit years, which can probably reach up until

9999. Your best bet for sending a long-life cookie is to send it for some

time late in the year "37".

</pre>

</section>

<directivesynopsis>

<name>CookieDomain</name>

<description>The domain to which the tracking cookie applies</description>

<syntax>CookieDomain <em>domain</em></syntax>

<contextlist>

<context>server config</context>

<context>virtual host</context>

<context>directory</context>

<context>.htaccess</context>

</contextlist>

<override>FileInfo</override>

<usage>

<p>This directive controls the setting of the domain to which

the tracking cookie applies. If not present, no domain is

included in the cookie header field.</p>

<p>The domain string <strong>must</strong> begin with a dot, and

<strong>must</strong> include at least one embedded dot. That is,

<code>.foo.com</code> is legal, but <code>foo.bar.com</code> and

<code>.com</code> are not.</p>

<note>Most browsers in use today will not allow cookies to be set

for a two-part top level domain, such as <code>.co.uk</code>,

although such a domain ostensibly fulfills the requirements

above.<br />

These domains are equivalent to top level domains such as

<code>.com</code>, and allowing such cookies may be a security

risk. Thus, if you are under a two-part top level domain, you

should still use your actual domain, as you would with any other top

level domain (for example <code>.foo.co.uk</code>).

</note>

</usage>

</directivesynopsis>

<directivesynopsis>

<name>CookieExpires</name>

<description>Expiry time for the tracking cookie</description>

<syntax>CookieExpires <em>expiry-period</em></syntax>

<contextlist>

<context>server config</context>

<context>virtual host</context>

<context>directory</context>

<context>.htaccess</context>

</contextlist>

<override>FileInfo</override>

<usage>

<p>When used, this directive sets an expiry time on the cookie

generated by the usertrack module. The <em>expiry-period</em>

can be given either as a number of seconds, or in the format

such as "2 weeks 3 days 7 hours". Valid denominations are:

years, months, weeks, days, hours, minutes and seconds. If the expiry

time is in any format other than one number indicating the

number of seconds, it must be enclosed by double quotes.</p>

<p>If this directive is not used, cookies last only for the

current browser session.</p>

</usage>

</directivesynopsis>

<directivesynopsis>

<name>CookieName</name>

<description>Name of the tracking cookie</description>

<syntax>CookieName <em>token</em></syntax>

<default>CookieName Apache</default>

<contextlist>

<context>server config</context>

<context>virtual host</context>

<context>directory</context>

<context>.htaccess</context>

</contextlist>

<override>FileInfo</override>

<usage>

<p>This directive allows you to change the name of the cookie

this module uses for its tracking purposes. By default the

cookie is named "<code>Apache</code>".</p>

<p>You must specify a valid cookie name; results are

unpredictable if you use a name containing unusual characters.

Valid characters include A-Z, a-z, 0-9, "_", and "-".</p>

</usage>

</directivesynopsis>

<directivesynopsis>

<name>CookieStyle</name>

<description>Format of the cookie header field</description>

<syntax>CookieStyle

<em>Netscape|Cookie|Cookie2|RFC2109|RFC2965</em></syntax>

<default>CookieStyle Netscape</default>

<contextlist>

<context>server config</context>

<context>virtual host</context>

<context>directory</context>

<context>.htaccess</context>

</contextlist>

<override>FileInfo</override>

<usage>

<p>This directive controls the format of the cookie header

field. The three formats allowed are:</p>

<ul>

<li><strong>Netscape</strong>, which is the original but now deprecated

syntax. This is the default, and the syntax Apache has

historically used.</li>

<li><strong>Cookie</strong> or <strong>RFC2109</strong>, which is the syntax that

superseded the Netscape syntax.</li>

<li><strong>Cookie2</strong> or <strong>RFC2965</strong>, which is the most

current cookie syntax.</li>

</ul>

<p>Not all clients can understand all of these formats. but you

should use the newest one that is generally acceptable to your

users' browsers. At the time of writing, most browsers only fully

support <code>CookieStyle Netscape</code>.</p>

</usage>

</directivesynopsis>

<directivesynopsis>

<name>CookieTracking</name>

<description>Enables tracking cookie</description>

<syntax>CookieTracking on|off</syntax>

<default>CookieTracking off</default>

<contextlist>

<context>server config</context>

<context>virtual host</context>

<context>directory</context>

<context>.htaccess</context>

</contextlist>

<override>FileInfo</override>

<usage>

<p>When <module>mod_usertrack</module> is loaded, and

<code>CookieTracking on</code> is set, Apache will send a

user-tracking cookie for all new requests. This directive can

be used to turn this behavior on or off on a per-server or

per-directory basis. By default, enabling

<module>mod_usertrack</module> will <strong>not</strong>

activate cookies. </p>

</usage>

</directivesynopsis>

</modulesynopsis>