fix(attribution): send the marketing site's HubSpot visitor token at registration - #410
Merged
Merged
Conversation
…registration, not the local cookie A visitor who comes from flamingo.run arrives with HubSpot's cross-domain `__hstc`, but a returning visitor's registration was still attributed to the openframe.ai `hubspotutk` cookie: HubSpot merges the incoming token only when its asynchronously computed browser fingerprint is ready at tracker start-up, which it is not, and the GTM seed covers first visits only. The contact then got a "direct" history instead of the marketing site's sessions and ad click. Capture the token from `__hstc` into localStorage at landing (last touch, the identity semantics HubSpot itself applies) and prefer it over the local cookie as `hutk` at submit. Acceptance rule mirrors the container's seed: a well-formed token next to `__hsfp`. Also point the test mock at localStorage — the module moved there in #305 and the first-touch test has been failing since — and note in the root redirect that the GTM replaceState race is closed in the container.
Contributor
🦩 Flamingo Code ReviewNo findings on the current head. Mode: advisory Need another pass? Commits pushed after this review are not reviewed automatically.
Prefer typing? Comment React 👍/👎 on inline comments to teach the reviewer. Started 2026-09-15 18:10 UTC · updated 2026-09-15 18:10 UTC · workflow run |
romanivan-flamingo
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A visitor coming from flamingo.run lands on
/auth?__hstc=…&__hssc=…&__hsfp=…, but a returning visitor's registration is attributed to the openframe.aihubspotutkcookie — the contact gets a "direct" history instead of the marketing site's sessions and ad click.Cause
HubSpot merges the incoming token only when its asynchronously computed browser fingerprint is already there at tracker start-up, which it is not. The GTM seed (
window.hubspotutk) covers first visits only: HubSpot ignores it once a__hstccookie exists.Fix
__hstcinto localStorage at landing (last touch — the identity semantics HubSpot itself applies) and prefer it over the local cookie ashutkat submit. Independent of the JS race.__hsfp.replaceStaterace is closed in the container; the hard fallback stays as insurance.Caveat
Neither the seed nor this verifies the fingerprint, so a forwarded handoff link attributes its registrant to the sender's visitor — the trade-off already made for first visits.
Verified:
npm run test:node37/37 (was 30/31),lint:ci, prettier,tsc.Sending side: flamingo-stack/multi-platform-hub#1284.