Skip to content

fix(vtex): gate vtex_segment cookie on isCacheableSegment #1642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
igoramf wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix(vtex): gate vtex_segment cookie on isCacheableSegment #1642

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a3318ba
fix(vtex): gate vtex_segment cookie on isCacheableSegment
igoramf Jul 15, 2026
7f31a43
fix(vtex): gate UTM cookie behavior behind removeUTMFromCacheKey
igoramf Jul 15, 2026
3a0259d
fix(vtex): gate middleware page cacheability on removeUTMFromCacheKey
igoramf Jul 15, 2026
fc94805
revert(vtex): drop middleware UTM gate; flag + cookie already cover it
igoramf Jul 15, 2026
4842ac6
fix(vtex): skip UTM in price simulation when removeUTMFromCacheKey is on
igoramf Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions vtex/utils/segment.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,9 +260,11 @@ export const setSegmentBag = (
});
}

// Only set vtex_segment when the channel is non-default so that default-SC
// responses remain cacheable by the CDN without a Set-Cookie header.
if (vtex_segment !== token && !isAnonymous(ctx)) {
// Only set vtex_segment on non-cacheable responses so cacheable ones (incl.
// UTM-only and non-default sales channel) stay Set-Cookie-free and CDN-
// cacheable. Mirrors the middleware's cacheability check (isCacheableSegment)
// so the cookie gate and the Cache-Control decision never disagree.
if (vtex_segment !== token && !isCacheableSegment(ctx)) {

@cubic-dev-ai cubic-dev-ai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: UTM-only requests now become publicly cacheable here, but simulation.ts still treats any UTM as non-anonymous and sends it as marketingData; a VTEX promotion keyed by that UTM can therefore produce a campaign price in a response shared with users without the UTM. Requests whose marketing data can affect pricing need to remain out of the public page cache, or those fields need to be excluded from simulation for cacheable requests.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At vtex/utils/segment.ts, line 267:

<comment>UTM-only requests now become publicly cacheable here, but `simulation.ts` still treats any UTM as non-anonymous and sends it as `marketingData`; a VTEX promotion keyed by that UTM can therefore produce a campaign price in a response shared with users without the UTM. Requests whose marketing data can affect pricing need to remain out of the public page cache, or those fields need to be excluded from simulation for cacheable requests.</comment>

<file context>
@@ -260,9 +260,11 @@ export const setSegmentBag = (
+  // UTM-only and non-default sales channel) stay Set-Cookie-free and CDN-
+  // cacheable. Mirrors the middleware's cacheability check (isCacheableSegment)
+  // so the cookie gate and the Cache-Control decision never disagree.
+  if (vtex_segment !== token && !isCacheableSegment(ctx)) {
     setCookie(ctx.response.headers, {
       value: token,
</file context>

@cubic-dev-ai cubic-dev-ai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: This gate removes only vtex_segment; a non-default ?sc=... request still executes the preceding setCookie(... name: SALES_CHANNEL_COOKIE) branch and returns Set-Cookie: VTEXSC. With the Cloudflare behavior described in this PR, that landing response still bypasses the CDN, so the claimed non-default-channel cacheability fix is incomplete.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At vtex/utils/segment.ts, line 267:

<comment>This gate removes only `vtex_segment`; a non-default `?sc=...` request still executes the preceding `setCookie(... name: SALES_CHANNEL_COOKIE)` branch and returns `Set-Cookie: VTEXSC`. With the Cloudflare behavior described in this PR, that landing response still bypasses the CDN, so the claimed non-default-channel cacheability fix is incomplete.</comment>

<file context>
@@ -260,9 +260,11 @@ export const setSegmentBag = (
+  // UTM-only and non-default sales channel) stay Set-Cookie-free and CDN-
+  // cacheable. Mirrors the middleware's cacheability check (isCacheableSegment)
+  // so the cookie gate and the Cache-Control decision never disagree.
+  if (vtex_segment !== token && !isCacheableSegment(ctx)) {
     setCookie(ctx.response.headers, {
       value: token,
</file context>

@cubic-dev-ai cubic-dev-ai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Logged-in UTM requests now skip vtex_segment even though middleware marks them no-store: this gate checks isCacheableSegment but not the same auth-cookie predicate used by middleware. The prior !isAnonymous path persisted this changed segment, so the gate should also retain the cookie for logged-in requests.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At vtex/utils/segment.ts, line 267:

<comment>Logged-in UTM requests now skip `vtex_segment` even though middleware marks them `no-store`: this gate checks `isCacheableSegment` but not the same auth-cookie predicate used by middleware. The prior `!isAnonymous` path persisted this changed segment, so the gate should also retain the cookie for logged-in requests.</comment>

<file context>
@@ -260,9 +260,11 @@ export const setSegmentBag = (
+  // UTM-only and non-default sales channel) stay Set-Cookie-free and CDN-
+  // cacheable. Mirrors the middleware's cacheability check (isCacheableSegment)
+  // so the cookie gate and the Cache-Control decision never disagree.
+  if (vtex_segment !== token && !isCacheableSegment(ctx)) {
     setCookie(ctx.response.headers, {
       value: token,
</file context>
Suggested change
if (vtex_segment !== token && !isCacheableSegment(ctx)) {
if (
vtex_segment !== token &&
(!isCacheableSegment(ctx) ||
Boolean(
cookies["VtexIdclientAutCookie"] ||
cookies[`VtexIdclientAutCookie_${ctx.account}`],
))
) {

setCookie(ctx.response.headers, {
value: token,
name: SEGMENT_COOKIE_NAME,
Expand Down
Loading