Thursday, June 09, 2011

Cookie Filtering, And Commenting Ability

Until late May 2011, we would see various odd and mysterious problem reports, about posting comments, in Blogger Help Forum: Something Is Broken.
I posted a comment, but now I can't delete it. It's labeled as "Anonymous" - even though I used my Google account!
and
I tried to publish my comment, but the Publish button doesn't do anything.
Both complaints were representative of the many different problem reports seen.

The problem, in general, starts with the need for authentication by the blog guest or owner, when trying to publish a comment. You authenticate yourself using the Blogger login wizard. When you authenticate, you create a login cookie, which is later used to identify you when you comment, when you Follow a blog (or maintain the Followers on your blog), and when you maintain or publish to your own blog. The login cookie is created under "blogger.com".

Cookies, an essential ingredient in our use of Blogger, have had a controversial past in the Internet, for a long time. Some people believe that filtering cookies, placed on our computers by untrustworthy websites, will allow us to safely visit those websites. Cookie filter settings are part of native browser option wizards, and menus in various browser add-on accessories.

Most cookie activity, in general, involves cookies created and read by scripts running within the same domain. Cookies designed to be created by scripts running from one domain, and read by scripts running from a second domain, are called third party cookies. Many people believe that third party cookies are more dangerous than normal ("first party") cookies. Some cookie filters contain specific settings to block third party cookies, even if normal cookies are permitted.

The complex domain infrastructure used by Blogger / Google necessitates the use of third party cookies. In the case of commenting, this need is caused by use of the Embedded comment form, which runs in the published domain of the blog - not "blogger.com". People who do not permit third party cookie access will have problems with using the embedded comment form.

Until May 2011, the various scripts used by the embedded comment form, in situations which required non permitted third party cookie access, provided no feedback to the hapless blog guest or owner. A person trying to comment, on a blog which permitted anonymous commenting, would generate an anonymous comment (even though intentionally selecting Google authentication). In cases where a blog did not permit anonymous comments, the comment script would simply terminate, leaving no clue.

In May 2011, the embedded commenting form scripts were changed. In cases where authentication is required - either with a blog that does not permit anonymous comments, or when the commenter has selected Google authentication intentionally - the guest is now presented with a login screen, and required to authenticate. If third party cookie access is not permitted, after authentication is completed, the script treats that as if authentication was not provided, and repeats the demand for authentication. This results in a login loop, with the "Remember me" option selected.

With "Remember me" not selected, third party cookie access not permitted, and anonymous commenting allowed, the comment is simply treated as anonymously posted. If anonymous commenting is not desired, or not permitted, the blog guest is again required to authenticate.

In many cases, for blog owners reporting volumes of complaints from blog guests, we have simply recommended changing the comment form style, to use a full page form. Not all blog owners have appreciated this advice.

The only real solution here, which will provide any long term consistency, is for all Blogger blog guests and owners to permit third party cookie access. Unfortunately, not all blog guests and owners are willing (or able) to do this, immediately. With layered security, varying levels of technical proficiency, and many different security programs and settings, finding a problematic filter setting is going to be frustrating for many. This is, nonetheless, a necessary solution.

Once again, we have a detail, similar to the current problem with the Follower gadget and script filtering, that really is the responsibility of each computer owner.

>> Top

32 comments:

Aunt Amelia's Attic said...

Thank you "RBS" for this detailed post on this issue.

I was not hit by it, but many were. I will post a link to this, and hope any of my Dear Readers, who have been effected, will come over here, and read your helping post.

Again, thank you!

~♥~

hopeandjoyhome said...

Holy Cripes I have been struggling with this for a month and asking questions on the Etsy Blog team and getting no answers and feeling like it was me and I was some sort of techno idiot even though I HAD been commenting right along..soooo irriatating..I wonder if I can even post this comment..if it says anonymous, I am hopeandjoyhome.blogspot I had been visiting lots of blog pages but when you don't comment, you don't get many return comments or visits..errrgggh.

Ifinder said...

Very very informative. Me new. Trying to understand.

DaisyCrazy said...

Thanks!
This is really clear and helpful to make me understand the reason some of my guests were facing problems leaving a comment in my blog.

Debbie said...

Thank you for this explanation. Now I know why I can comment on some blogs and not on others.

Crosby Kenyon said...

As always, another learning curve. This was very informative.

Suzanne said...

I'm hoping I'm not "anonymous said..."

God Is Enthralled By Your Beauty said...

Thank you so much for your detailed post and for answering my question on blogger. You are awesome!!! Thank you, thank you, thank you!

Suzanne said...

I did opt for full page comments but I also now access my blog via Google's Chrome. Works like a treat. Thanks again.

Samuel Wales said...

I like your blog.

A possible solution here, maybe.

I have full page comments as you suggest, so that I don't have to instruct readers to debug and possibly even downgrade their layered security. But I prefer comments at the end of posts for style and accessibility.

I don't really care what it looks like when people post a comment; I care what it looks like when they read comments.

Existing comments are already shown on the post page, but not on the home page. When you click on comments at the end of the home page post, you get the full page comment form. Even if you only want to read comments.

In lieu of Google using a single domain name, here is a possible fix.

Make the link on the home page go not to the full page comments, but to the post page anchor that begins comments. Then if a user wants to comment, he can do so from a link there.

Is this possible or desirable?

P.S. (Unrelated) I notice your blog has an option to email followup comments. Is that a Blogger in Draft feature?

yahgirltiffy said...

Just testing

Randy, Denise, Camden Denson said...

testing

Samuel Wales said...

Has this been improved enough that we can enable comments in the only way that is pretty?

If not, is there a way to make the home page comments button go to the post page while the post page uses the comment form for making comments?

Chuck said...

Samuel,

The full page comment form is pretty enough. Or, if your readers can setup their computers properly, they can use an embedded comment form.

If people allow their computers to filter cookies inappropriately, though, they won't be able to use embedded comment forms.

Samuel Wales said...

Hi Chuck,

The full page form does not work well with very large fonts.
Set your browser to maximum font size (many people do need that) to demonstrate.

There is overlapping text and the column on the left is very narrow.

This does not happen on the post page.

If the form could be at your own domain, then perhaps the cookie problems would be fixed?

I guess Blogger can't do that?

Samuel Wales said...

Are you saying that people should not disallow 3rd party cookies?

Chuck said...

Samuel,

If you want to use all Blogger features, you need to permit third party cookie access.

http://blogging.nitecruzr.net/2009/06/why-need-for-third-party-cookies-in.html

Lisa said...

testing

Gigi said...

thanks

magicwanda said...

testing

Katee said...

Been trying to make comments on blogs that previously, were no trouble. Wondering if this will post?

Wikki Bloggkatten said...

ghkj

thereislight said...

just testing

thereislight said...

just testing

JRandSue said...

Just Testing. JRandSue

Janet said...

I really don't understand most of what you say in this post. Is it possible to give me a simple solution to the problem of blogs not accepting my posts?

Randy said...

This is a test

Needham said...

cookie test

Terry Pearson said...

Thank you, thank you, thank you! I struggled endlessly, and failed, to post a comment on the blog of friends who are on a 147-day(!) exploration of Australia and New Zealand. At your suggestion I set my computer to allow third-party cookies and POW, success. You are a genleman and a scholar (but I suppose you knew that).

T said...

-- testing (and thanks for the help)

Antonia Lindsay said...

testing

Javi Monzón said...

Hi there!

This is Javi, the guy that's been asking for help on the Blogger Help Forums!

Thanks a lot for all your help, you have been great!

And congratulations on your blog, it's full of valid information!