{"action":"opened","issue":{"url":"https://api.github.com/repos/hasgeek/hasjob/issues/223","labels_url":"https://api.github.com/repos/hasgeek/hasjob/issues/223/labels{/name}","comments_url":"https://api.github.com/repos/hasgeek/hasjob/issues/223/comments","events_url":"https://api.github.com/repos/hasgeek/hasjob/issues/223/events","html_url":"https://github.com/hasgeek/hasjob/issues/223","id":107559870,"number":223,"title":"Event sessions shouldn't be issued to bots","user":{"login":"jace","id":26695,"avatar_url":"https://avatars.githubusercontent.com/u/26695?v=3","gravatar_id":"","url":"https://api.github.com/users/jace","html_url":"https://github.com/jace","followers_url":"https://api.github.com/users/jace/followers","following_url":"https://api.github.com/users/jace/following{/other_user}","gists_url":"https://api.github.com/users/jace/gists{/gist_id}","starred_url":"https://api.github.com/users/jace/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jace/subscriptions","organizations_url":"https://api.github.com/users/jace/orgs","repos_url":"https://api.github.com/users/jace/repos","events_url":"https://api.github.com/users/jace/events{/privacy}","received_events_url":"https://api.github.com/users/jace/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-21T17:28:43Z","updated_at":"2015-09-21T17:28:43Z","closed_at":null,"body":"Any cookie-capable site-visitor is considered a human and assigned a browsing session. However, bots also accept and play back cookies and get assigned a session, defeating the intent of using sessions for user tracking. Since the definition of a 'bot' is not specific:\r\n\r\n1. Known bots can be tagged by their User-Agent string and excluded from sessions. Among them:\r\n    * Googlebot\r\n    * Baiduspider\r\n    * Yahoo! Slurp\r\n    * Wget\r\n    * curl\r\n    * Python-requests\r\n    * Flipboard\r\n    * Livelapbot\r\n    * facebookexternalhit\r\n    * \"@ozilla/5.0\"\r\n    * ActiveBookmark\r\n    * Activeworlds\r\n    * ActiveWorlds\r\n    * \"Airmail%202/303\"\r\n    * Akregator\r\n    * Apache-HttpClient\r\n    * Aplix\r\n    * Apple-PubSub\r\n\r\n2. Test for JavaScript execution ability and only then assign a session. This could be achieved by setting a test cookie in JavaScript and only creating a session when this cookie is received. However, Hasjob uses `/_sniffle.gif` to set a session (as other static resources may be delivered by an intermediate web server or may be off-domain), and this image may be loaded *before* JavaScript is executed, forcing session creation to wait until the user loads another page, which will mean all first-page bounces are now lost. (This can be offset by loading `_sniffle.gif` from within JS).\r\n\r\n3. Use combination of both methods to throw off JS-executing bots like Googlebot.\r\n"}}