Google analytics stores username and password as a part of url

时间:2016-04-15 15:04:19

标签: security url meteor google-analytics credentials

Issue Context:

I am using meteor js for a mobile app. I have hooked it up with google analytics calls and basically I am using two type of calls:

  1. Screen views
  2. Events

Screen views are just fine, but I'm facing an issue with the events.

When I go to Behavior -> Events -> Screens, in the google analytics dashboard, I can see the URL of every page that has triggered an event under the Screen Name column. My problem is that the page URLs for my login page look something like this:

meteor.local/login?username=*******&password=+++++++&rememberMe=on

Where ******* is an actual username and +++++++ is the corresponding password!


Reason:

Since I have to share this analytics account with multiple people, I do not want this information to be available over here.


Clues:

CLUE 1:

I used to do GET http calls, but I have changed them all to POST and it still has not fixed the issue as I expected it not to pass plain parameters through URL anymore.

CLUE 2:

I've noticed that the default google analytics js framework is working with http and not https. I was wondering if it is calling the analytics server with a GET as well. If so, is there anyway to change that?

CLUE 3:

Here is how I am initiating the GA instance:

(function (i, s, o, g, r, a, m) {
    i['GoogleAnalyticsObject'] = r;
    i[r] = i[r] || function () {
            (i[r].q = i[r].q || []).push(arguments)
    }, i[r].l = 1 * new Date();
    a = s.createElement(o),
    m = s.getElementsByTagName(o)[0];
    a.async = 1;
    a.src = g;
    m.parentNode.insertBefore(a, m)
})(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');

ga('create', googleKey, 'auto');

CLUE 4:

I have also noticed that these URLs are getting captured very occasionally. E.g. in the pas 12,500 unique events (about 30,000 total events) it has captured just 9 URLs with the username and password. The remaining 12,491 events have

meteor.local/login

OR

meteor.local/--

OR

localhost/--

as the Screen Name.

CLUE 5:

I have also put 4 "search and replace" global filters on the analytics account to search for this string

meteor.local/.*

and replace it with this one

meteor.local/concealedURI

This does not seem to be working either. I have added this filter on 4 different fields (Since I still really don't know where the URLs are coming from):

  1. Host Name
  2. Page Title
  3. Referral
  4. Request URI

CLUE 6:

This is how I am calling the GA instance to send the event:

ga('send', 'event', 'button', 'click', eventName);

1 个答案:

答案 0 :(得分:2)

好。因此,我必须进行大量实验并尝试不同的方法来解决这个问题。

在尝试了我在问题中描述的所有内容后,我终于找到了解决此问题的方法。

此问题的主要原因是我使用谷歌分析帐户设置来跟踪应用程序,以从使用<构建的应用程序捕获数据strong> meteor js (基本上使用 cordova )。

使用meteor意味着我的应用程序的屏幕实际上是网页呈现为移动应用程序。似乎meteor使用URL来浏览这些屏幕。

另一方面,当从该页面触发事件时,谷歌分析会查看(并捕获)应用程序页面的屏幕名称。在原生应用中,此屏幕名称类似于&#34;关于我们&#34;,&#34;联系我们&#34;,&#34;主页&#34;等< / p>

现在由于流星应用程序不一样, meteor返回的屏幕名称实际上是触发事件的页面的URL。

这与http调用没有任何关系(无论是否为GET或POST),因为它是meteor用于导航的本地URL,传递给谷歌分析而不是任何http调用。

解决方案

1

如果我将Google Analytics分析帐户设置为网页跟踪器,则可以访问&#34;排除网址查询参数&#34;字段和我可以排除用户名和密码,如@Mike和@PhilipPryde在评论中所建议的那样。 但是,我需要将Google Analytics分析设置为应用跟踪器。所以,这对我没用。

<强>失败

2

我确实在google analytics中对整个视图进行了过滤,并搜索了meteor.local /.*并将其替换为hiddenURL。

上的过滤器
  • 主机名
  • 页面标题
  • 推荐
  • 请求URI

没用。

但是当我把相同的过滤器放在

上时
  • 屏幕标签

字段,它有效。

但是,这只会查看屏幕视图点击返回的屏幕名称,而不是事件。因此,这实际上并没有解决我的问题。

<强>失败

最后,我必须这样做:

GA实例上有一个方法调用,可让您设置不同的选项。我最终使用了这个:

ga('set', 'screenName', 'hiddenURL');

这会将屏幕名称更改为&#34; hiddenURL&#34;。所以,我在每次活动之前使用过这个,这对我有用。 我将事件发送到Google Analytics的代码如下所示:

ga('set', 'screenName', 'hiddenURL');
ga('send', 'event', 'button', 'click', eventName);

<强> PS:

每当有人触发某个事件时,这会将Google分析的实时报告中显示的屏幕名称更改为&#34; hiddenURL&#34;。但是,一旦它们转到另一个页面,它就会变回屏幕名称。因此,它也不会弄乱你的任何屏幕视图数据,因为它没有被捕获为屏幕视图。

当然那是因为我每次发送屏幕视图时都会将屏幕名称传递给我的GA实例。所以它看起来像这样:

sendScreenViewToGA = function (screenName) {
    ga('send', 'screenview', {
        'appName': 'Something',
        'screenName': screenName,
        'appVersion': x.x
    });
}

如果我使用了屏幕名称,现在环境设置正确,我最终会将所有屏幕名称分析设置为&#34; hiddenURL&#34;。

我真的希望这篇文章可以帮助其他人解决同样的问题并节省一些时间。