ip-cookie-audit

Custom Lighthouse audits for cookies and tags.

An audit can be run for single or multiple URL's which generates a report and then saves this locally. Batch processing allows tracking of cookies and tags across a user journey.

Installation

npm i -g ip-cookie-audit

Usage

privacyaudit --config <pathToConfig> or npx ip-cookie-audit --config

To run a audit a config file must be created.

Config File

Basic config

{
  "journey": [
    {
      "url": "",
      "headers: {},
      "ignoreTags: []
    }, 
    {
      "url": ""
    }
  ],
  "headers": {},
  "ignoreTags": [],
  "domain": "",
  "collate": true
}

| Key | Values | Usage | Required | |---|---|---|:---:| | journey | Array of Journey objects | A list of URL's for audit | Y | | collate | Boolean | Report config | Y | | domain | String | Product / domain being audited e.g. FT.com | Y | | headers| Object | Headers can be set at top level to apply to all URL's, or specific to URL within journey objects | N | | ignoreTags| Array of strings and/or RegEx | IgnoreTags can be set at top level to apply to all URL's or specific to URL | N | | url | String | URL for Audit | Y |

Journey object headers and ignoreTags will overide top level headers and ignoreTags.

ignoreTags

Tags are collected by tracking network requests and then filtering by domain. To filter out requests to known services e.g. fastly then a Regular Expression, or Keyword can be added to ignoreTags.

Example config file format

{
  "journey": [
    {
      "url": "https://www.ft.com/"
    },
    {
      "url": "https://www.ft.com/opinion",
      "headers": {
        "Cookie": "FTCookieConsentGDPR=true"
      },
      "ignoreTags": ["spoor", "origami", "fastly"]
    }
  ],
  "headers": {
    "ft-cookie-ftsession": [SESSION_TOKEN],
    "ft-cookie-ftsession-s": [SESSION_TOKEN],
    "fastly-debug": "1",
    "cookie": "FTCookieConsentGDPR=true"
  },

  "ignoreTags": ["fastly"],
  "domain": "ft.com",
  "collate": true
}

Reports

The default report is a collated report across all the URL's provided within the config.json file. The report will save under the following path:

./reports/report.json

Reports will overwriten each time command is run

privacyaudit --config <path>

This command shows a list of all cookies found by First and Third party, along with a list of all tags. The report does not provide a breakdown of cookies and tags per URL.

If you would like a report that provides a breakdown of cookies and tags by URL, there are two options.

To generate a report to show all cookies and tags found for each URL:

• Through the config file
  • by setting collate to false.

"collate": false

This report will not de-duplicate cookies across URL's.

To generate a report to show all unique cookies found for each subsequent URL:

• Through the cli
  • pass --unique flag when running an audit

privacyaudit --config <path> --unique

This report will de-duplicate cookies and tags across multiple URL's.

| Flag | Example | Usage | |---|---|---| | -c --config | privacyaudit -- --config ./config.json | Run app with a config file| |-u --unique | privacyaudit -- --unique --config [PATH] | Report including URL's with consecutive cookies and tags found with each subsequent URL | |-s --silent|privacyaudit -- --silent --config [PATH]| Log errors, then continue. |

If installing through git - please see here