Amplitude is adding too many cookies causing 400 Bad Request errors

Expected Behavior

I can browse websites without issues and unwanted cookies

Current Behavior

The amplitude library keeps adding junk and seemingly duplicate cookies to my requests, eventually so many that web servers like nginx stop responding to requests

Possible Solution

Stop adding duplicate cookies, respect user’s desire not to be tracked

Steps to Reproduce

I have tracked this down to partly being because of the Intention Chrome extension, partly this library not respecting user’s who block tracking (via uBlock origin), but I feel like your library shouldn’t be adding so many duplicate cookies.

I will definitely have to file a bug with the Intention Chrome extension and their use of buggy user tracking software.

I have uBlock origin which I use to block these types of trackers and I suspect that your library doesn’t know how to properly behave when this happens. What I see happening in while I’m browsing https://news.ycombinator.com/news every time I navigate to a new link on that site a set of amp_cookie_test and _tldtest with a random id is appending to my cookies list, along with one amplitude_testycombinator.com cookie. Eventually their nginx server responds with a 400 bad request error because one of the request headers is too big (because of all of the cookies). The only way to do a temporary fix it to close ALL of my tabs from that website, then use Chrome to delete the cookies for that site (but it starts to add up soon again and eventually it happens again).

On every request to this site (ycombinator news), I see a blocked request to api.amplitude.com (blocked by uBlock) which is what makes me really suspect this is an issue with Amplitude.

Here is a sample curl request to demonstrate the problem

curl -v 'https://news.ycombinator.com/' \
  -H 'Connection: keep-alive' \
  -H 'Cache-Control: max-age=0' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.67 Safari/537.36' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \
  -H 'Sec-Fetch-Site: none' \
  -H 'Sec-Fetch-Mode: navigate' \
  -H 'Sec-Fetch-User: ?1' \
  -H 'Sec-Fetch-Dest: document' \
  -H 'Accept-Language: en-US,en;q=0.9,es-US;q=0.8,es;q=0.7' \
  -H 'Cookie: user=censored; __unam=censored; amp_cookie_testAIUzG1g_ytw1EjiqDwMwwe=Fri Nov 20 2020 18:01:51 GMT-0500 (Eastern Standard Time); _tldtest_IVu4pXoiDqSagzP1AYutXt=1; _tldtest_f6SOuIp5Eu7v7ZDRjzQlg9=1; amp_cookie_testA8wCBWnUWvZIpaX13MWsft=Fri Nov 20 2020 18:01:51 GMT-0500 (Eastern Standard Time); amp_cookie_testh0cbOoNR0mXG5B1T8etXXJ=Fri Nov 20 2020 18:02:10 GMT-0500 (Eastern Standard Time); _tldtest_vLZuK7y6rSm9DpyYrhCDmv=1; _tldtest_irX9aSt9NHrBJ75_gTB6ES=1; amp_cookie_test5prx1nYLh7Ie-n1aFZNvX1=Fri Nov 20 2020 18:02:10 GMT-0500 (Eastern Standard Time); amp_cookie_testQhpzcpdyOCaD9Wss_Kn151=Fri Nov 20 2020 18:03:17 GMT-0500 (Eastern Standard Time); _tldtest_L_fj8g3LsytdRi6No3Pqa9=1; _tldtest_MSOwbvUAIOSbny-vOnY78L=1; amp_cookie_testWphYewqSFZNhMDnukhC-39=Fri Nov 20 2020 18:03:17 GMT-0500 (Eastern Standard Time); amp_cookie_testsx3KmXvg2I0SeKK1gH5x2Q=Fri Nov 20 2020 18:03:19 GMT-0500 (Eastern Standard Time); _tldtest_UWDwNVFTA7kt4t3PTf9cu1=1; _tldtest_ofhH7yaTekZV-lLmRBEuU-=1; amp_cookie_test2K_9a7IBOZZPthIV1646jZ=Fri Nov 20 2020 18:03:19 GMT-0500 (Eastern Standard Time); amp_cookie_testXIhrTgiFdLsjakb9ZPyFtz=Fri Nov 20 2020 18:03:21 GMT-0500 (Eastern Standard Time); _tldtest_rwdLmuIA9b9TNIcVuMQfHP=1; _tldtest_GCJH-EHHk2xPSFqdKa5t1r=1; amp_cookie_testRgyfaU5P83OCUuXEhhA4Ot=Fri Nov 20 2020 18:03:21 GMT-0500 (Eastern Standard Time); amp_cookie_testa8Uf58dgic8qaMIjeC5hKS=Fri Nov 20 2020 18:05:56 GMT-0500 (Eastern Standard Time); _tldtest_mulBLQQVz5Rt7UxAJFyOjG=1; _tldtest_ccUO1lhAFU9X8SFf4Rle-9=1; amp_cookie_testgX2aNNCkWL5e7-F7fnk94C=Fri Nov 20 2020 18:05:56 GMT-0500 (Eastern Standard Time); amp_cookie_testJeiJymzGnT5rWD-3Y3uqZG=Fri Nov 20 2020 18:05:58 GMT-0500 (Eastern Standard Time); _tldtest_JDS7qqVGqLCrPBVe1ZBV8g=1; _tldtest_H7bdiOSrsFbkkGotWuddtZ=1; amp_cookie_test4oyJWvlkh2fud9HXJe-NFk=Fri Nov 20 2020 18:05:58 GMT-0500 (Eastern Standard Time); amp_cookie_testL9JjYbuJ0mc9HZljTbTa84=Fri Nov 20 2020 18:06:02 GMT-0500 (Eastern Standard Time); _tldtest_syHVHmpKJ--rfYh57oVXbM=1; _tldtest_lJHHvjs_Z-qU6F66PHYhyW=1; amp_cookie_test06CskOV5FuCkO-ogZEijkG=Fri Nov 20 2020 18:06:02 GMT-0500 (Eastern Standard Time); amp_cookie_test5GrGPp9xuELa_a3V8C4m3R=Mon Nov 23 2020 15:49:21 GMT-0500 (Eastern Standard Time); _tldtest_-wFb11TWeIpvNu0qlFkAi7=1; _tldtest_gifRAzdloZ3T5Cw88aYhVA=1; amp_cookie_testI0zsF-LrqCs8vwmRItBYQ3=Mon Nov 23 2020 15:49:21 GMT-0500 (Eastern Standard Time); amp_cookie_testsc2_yvu8CyznklNPQfPmYj=Mon Nov 23 2020 15:49:33 GMT-0500 (Eastern Standard Time); _tldtest_26K9ZK1IJ1h0y9lH9ib22n=1; _tldtest_3ZvvpPB6BaAASts2wlpqpw=1; amp_cookie_test8O2qlm9I2OdKCqgYoMzQoK=Mon Nov 23 2020 15:49:33 GMT-0500 (Eastern Standard Time); amp_cookie_testHJ30ZTWYtNWPBfK3DpAwKY=Mon Nov 23 2020 15:49:44 GMT-0500 (Eastern Standard Time); _tldtest_3GYKVUY2GhtM_mDqh8Rink=1; _tldtest_QqQUkt4tyuMZzuLlsu5YGZ=1; amp_cookie_testEVuVZt4w-noetLQgb96xYo=Mon Nov 23 2020 15:49:44 GMT-0500 (Eastern Standard Time); amp_cookie_testC5HyCnAoigQMXYo1bY2B1A=Mon Nov 23 2020 16:28:50 GMT-0500 (Eastern Standard Time); _tldtest_CRtX04P-74XViZVqARTujT=1; _tldtest_ZzLDJY_Mz4OEboQ3nkShzA=1; amp_cookie_testH-KldUOXerJ4XPMpqP055p=Mon Nov 23 2020 16:28:50 GMT-0500 (Eastern Standard Time); amp_cookie_test0QZVa-9ZvUVd1AgKZpNA1z=Tue Nov 24 2020 11:44:25 GMT-0500 (Eastern Standard Time); _tldtest_W0SpvYlOoqKFHJrmTWigsz=1; amp_cookie_testlNbithgKiG8Onnl-C0JAl0=Tue Nov 24 2020 11:44:25 GMT-0500 (Eastern Standard Time); amp_cookie_testj02pD20RPQW0MXnB_ITvpk=Tue Nov 24 2020 11:45:14 GMT-0500 (Eastern Standard Time); _tldtest_y5QGAyY0j1d6_jjN0YIRnc=1; _tldtest_p08diUV2_jjY-E3Np1JWdQ=1; amp_cookie_testo32AKDc03K04gtShIZQzPU=Tue Nov 24 2020 11:45:14 GMT-0500 (Eastern Standard Time); amp_cookie_testyC5hffY6ZtZmi9LBprwEwI=Tue Nov 24 2020 11:53:39 GMT-0500 (Eastern Standard Time); _tldtest_CC_8qE0k1js2nspcMxfoQP=1; _tldtest_lWbfofF2ealp6qwn_DOquu=1; amp_cookie_testVWL4gHjWpNTenQPjB4E1mH=Tue Nov 24 2020 11:53:39 GMT-0500 (Eastern Standard Time); amp_cookie_testDi7YP6R58BLrkxnkbrHI8o=Tue Nov 24 2020 11:58:23 GMT-0500 (Eastern Standard Time); _tldtest_LM6FOK-DpyP_cm2t1OekLt=1; amp_cookie_testFnW4nAjsNv1jySXRMTmjTC=Tue Nov 24 2020 11:58:23 GMT-0500 (Eastern Standard Time); amp_cookie_testIKRM7V3qC1XMiR0Cpq5KGH=Tue Nov 24 2020 11:58:24 GMT-0500 (Eastern Standard Time); _tldtest_-cAu--splQlk6xSmlSC0T2=1; _tldtest_BSHrN8elnwra3fdDF9Omvf=1; amp_cookie_testmpTXqLk8RFvpWE3zc_o5ig=Tue Nov 24 2020 11:58:24 GMT-0500 (Eastern Standard Time); amp_cookie_testGHq0FFcowCWUpJ1BUr4wN4=Tue Nov 24 2020 11:58:55 GMT-0500 (Eastern Standard Time); _tldtest_pSg2cvz-sczNOBSl69nod6=1; _tldtest_qyvh-4Gh0z6W8VItxlMebJ=1; amp_cookie_test0H2rdDuR-4ChSIom6t1ZKi=Tue Nov 24 2020 11:58:55 GMT-0500 (Eastern Standard Time); amp_cookie_testcJBDfVaQ8jnNeLviOxVCfN=Tue Nov 24 2020 12:00:16 GMT-0500 (Eastern Standard Time); _tldtest_TE8c0BOYCgWY7Fei5yO6RC=1; amp_cookie_testKVllGD5AWgnBDjYZ-E3DQF=Tue Nov 24 2020 12:00:16 GMT-0500 (Eastern Standard Time); amp_cookie_testjfJVV2_y38WIj12CYlTHW5=Tue Nov 24 2020 12:00:17 GMT-0500 (Eastern Standard Time); _tldtest_tjw0u8T0V5HXfDKxi3DH4v=1; _tldtest_KWyTO_Xac7CC5Ab0vlQJiY=1; amp_cookie_testU75wDPcDq2aQb7fomsm_2s=Tue Nov 24 2020 12:00:17 GMT-0500 (Eastern Standard Time); amp_cookie_testI0HaoPPQK7NZUnX2zJqCGU=Tue Nov 24 2020 12:00:19 GMT-0500 (Eastern Standard Time); _tldtest_f9Ox5AEQckyaHmH_VWjG6R=1; _tldtest_9NsbHEQgEYnKXFzOg_vSR4=1; amp_cookie_testYwqZnJcd5h4vxk0PxOyVJH=Tue Nov 24 2020 12:00:19 GMT-0500 (Eastern Standard Time); _tldtest_H4rjflhDOTYRFXL-9i20DO=1; amp_cookie_testlJKsGEzPtZYXdMaxPuTLwc=Tue Nov 24 2020 12:00:24 GMT-0500 (Eastern Standard Time); amp_cookie_testdj10_HxXuJg3ql1gkLc09Z=Tue Nov 24 2020 12:00:26 GMT-0500 (Eastern Standard Time); _tldtest_lO8ZbuoUPFbquM5MUcF5QL=1; _tldtest_YC2qbna50kyusfWGKgKIbR=1; amp_cookie_testTa9FshJrEk_UKEYLVLXlCe=Tue Nov 24 2020 12:00:26 GMT-0500 (Eastern Standard Time); amp_cookie_testEra1AaFtzPy0V5YDPGkGu0=Tue Nov 24 2020 12:00:36 GMT-0500 (Eastern Standard Time); _tldtest_ry9ep3m8WCMgJ8a1wgirVt=1; _tldtest_vjzZ8_rHdSHcnYovXm3T6m=1; amp_cookie_testcZXRBe01khMaJRJqkHju5r=Tue Nov 24 2020 12:00:36 GMT-0500 (Eastern Standard Time); amp_cookie_test-toAqw8RAEb4JMFxYGK9vl=Tue Nov 24 2020 12:00:42 GMT-0500 (Eastern Standard Time); _tldtest_iwVbAp_o0XBYOiBaIQ6tgL=1; _tldtest_Wdh9sd6EfnTpkCEwCDOuEG=1; amp_cookie_testyWgUFWeRSYcgNUsuhSXXMe=Tue Nov 24 2020 12:00:42 GMT-0500 (Eastern Standard Time); amp_cookie_test_xYZexVVqxawKUTIZAGbKZ=Tue Nov 24 2020 12:53:21 GMT-0500 (Eastern Standard Time); _tldtest_elRQM6pXHpBP-_hE7mIRXu=1; _tldtest_CopOHGtL8YJZvLp9NHngyG=1; amp_cookie_testDdwRLEZB7L84KrsQH72qpM=Tue Nov 24 2020 12:53:25 GMT-0500 (Eastern Standard Time); _tldtest_jF_JZ5pNPPkXUgSmmX6Jsl=1; _tldtest_0xV_Y2SgpzV_ZsfCtgZYag=1; amp_cookie_testhvfHVnVScZEEnG0YPZE4Gp=Tue Nov 24 2020 12:53:25 GMT-0500 (Eastern Standard Time); _tldtest_af_t48DW4P7korALW1JOpp=1; _tldtest_QR4H0t9rIKPyotmmaRIc9z=1; amp_cookie_testYJa8vJAuEwsepF_uBGhHDa=Tue Nov 24 2020 12:53:39 GMT-0500 (Eastern Standard Time); amp_cookie_testGQvqTr02O2Dz2FVNbAeA-I=Tue Nov 24 2020 14:06:31 GMT-0500 (Eastern Standard Time); amp_cookie_testGok-sKDXJPPA1RC1YkwHS0=Tue Nov 24 2020 14:06:39 GMT-0500 (Eastern Standard Time); _tldtest_H5zqkp7zOakMTDS20efxk3=1; _tldtest_CUk0epM_ODQe3uFPdJFLHd=1; amp_cookie_test51zfaBMyTdplIG8ErpwW5m=Tue Nov 24 2020 14:06:39 GMT-0500 (Eastern Standard Time); _tldtest_uj-nKO8IcCAPUpCMQDPUTS=1; amp_cookie_test3kYl9V1NYK7PMssGqu35cq=Tue Nov 24 2020 14:06:47 GMT-0500 (Eastern Standard Time); amp_cookie_test_rgP03zfT_mi3Q2JP8g4OB=Tue Nov 24 2020 14:06:49 GMT-0500 (Eastern Standard Time); amp_cookie_testxBp0jSTXMpRIJwjzq0JUaM=Mon Nov 30 2020 10:42:22 GMT-0500 (Eastern Standard Time); _tldtest_jS4ZVwIFxiEhaYJ8BxStvl=1; _tldtest_KuR0NPEUYDa6CC9H1qzLBp=1; amp_cookie_testmOXZbBNqGSMQqK3KkXCswp=Mon Nov 30 2020 10:42:22 GMT-0500 (Eastern Standard Time); _tldtest_S-_VMkVK1POs2YmMAV9DjZ=1; _tldtest_KzN7-fOyxDmg6l-ybNDSWR=1; amp_cookie_testrMNnXZodvAxpssKw7VlTDj=Mon Nov 30 2020 10:42:42 GMT-0500 (Eastern Standard Time); _tldtest_7JHq_eAokN_Tjdb_UZgHvu=1; amp_cookie_testUElYnT-Rbrf_7yM3enEbVC=Mon Nov 30 2020 10:42:49 GMT-0500 (Eastern Standard Time); _tldtest_zVrfDnfpNvmctHD0779KPb=1; amp_cookie_testzjh5ZCG99820otxWrb35ob=Mon Nov 30 2020 10:42:54 GMT-0500 (Eastern Standard Time); amp_cookie_testEk7AQW2BJl3Oie2Z-Iw22N=Mon Nov 30 2020 10:45:07 GMT-0500 (Eastern Standard Time); _tldtest_JyduKjVmWNmk3ASNitsNfD=1; _tldtest_F_vu7K2WTdkyIQ9xaQOaE1=1; amp_cookie_testbUBdVKWmdTDMPnh_kAEg_P=Mon Nov 30 2020 10:45:07 GMT-0500 (Eastern Standard Time); amp_cookie_testSDdHkRCobpkOG2U_nLu2s3=Mon Nov 30 2020 10:45:43 GMT-0500 (Eastern Standard Time); _tldtest_G0s5i93SeddxSTLJTXZC4c=1; _tldtest_Bd2HB04-3tcqV1qZZ49_BY=1; amp_cookie_test79Xbxcw2pWk9w-knhYo7xj=Mon Nov 30 2020 10:45:43 GMT-0500 (Eastern Standard Time); amp_cookie_testi-oldPhof4Z1eV0Z3LCM32=Mon Nov 30 2020 11:01:32 GMT-0500 (Eastern Standard Time); _tldtest_sCUxaRvxTllqpE2rhtvHPs=1; _tldtest_iBIy7ngSiVjttpsHcY2SXO=1; amp_cookie_testGtzW3EnnhHv1ES1dgeOcgK=Mon Nov 30 2020 11:01:32 GMT-0500 (Eastern Standard Time); amp_cookie_testLauZUB3JqVCxgh8aJKmvE6=Mon Nov 30 2020 11:02:27 GMT-0500 (Eastern Standard Time); _tldtest_ooRR6W4gjFBI7nqktwigXF=1; _tldtest_Q0Ao8cLy80qZIJP1w78Ga2=1; amp_cookie_tests-PfwfznY4teNrsRR0R8Yd=Mon Nov 30 2020 11:02:27 GMT-0500 (Eastern Standard Time); _tldtest_oRKnW0SG4Zto0OmnyQdhcN=1; amp_cookie_test-9VDNyX4mAAMvZyApRTdyj=Mon Nov 30 2020 11:15:05 GMT-0500 (Eastern Standard Time); _tldtest_UheyCL3iZPaiMPxtKNhbbc=1; _tldtest_3jLKw1hp_cYwtuY7MFDdsC=1; amp_cookie_testtyfCHiebuuRZTF6M46_wJN=Mon Nov 30 2020 11:15:05 GMT-0500 (Eastern Standard Time); amp_cookie_test9LAwP7sr_EFVRB3BmLaGzC=Mon Nov 30 2020 11:15:05 GMT-0500 (Eastern Standard Time); _tldtest_-tUZRpqJT6joMEMs2sU_Ac=1; _tldtest_URf1EDq6gOpVvtxh6zeMlc=1; amp_cookie_testFcAbSAcOGrHuz8_lELtciE=Mon Nov 30 2020 11:15:05 GMT-0500 (Eastern Standard Time); _tldtest_KruLhMyQxLisHG38CfBEgA=1; amp_cookie_testqHDnIHyDPDAt-9nPHbEcHG=Mon Nov 30 2020 11:15:05 GMT-0500 (Eastern Standard Time); amp_cookie_testSTsujVP66Xwqz3-haxYXsz=Mon Nov 30 2020 11:15:05 GMT-0500 (Eastern Standard Time); _tldtest_9RjatrGHttTc2zEAPyimgV=1; _tldtest_wWDIj2tRY1Rr9WkyvkBi5_=1; amp_cookie_testURrn1k56ktMEcukEv93Dku=Mon Nov 30 2020 11:15:05 GMT-0500 (Eastern Standard Time); amp_cookie_testWZk6ZnumdJiE0bo5K2d6cj=Tue Dec 01 2020 15:28:55 GMT-0500 (Eastern Standard Time); _tldtest_IiNA8RFOkLXOpDudvwpIJr=1; _tldtest_wRIWkaOCj2apIBVZrI4pjR=1; amp_cookie_testwMLg-k1bwppRiOtrhQ-oRA=Tue Dec 01 2020 15:28:55 GMT-0500 (Eastern Standard Time); amp_cookie_testkC3ptMIMas7_PBBsZ9l3oh=Tue Dec 01 2020 15:54:35 GMT-0500 (Eastern Standard Time); _tldtest_ekZMSa-9M63ruaX-xZZB5n=1; _tldtest_qZNIjPtia2a9ejO0NMRV3U=1; amp_cookie_testj5j_i23SDum44Tp7rQtEW7=Tue Dec 01 2020 15:54:35 GMT-0500 (Eastern Standard Time); amp_cookie_testEqck_htCQSaZQXubX_h4Bp=Wed Dec 02 2020 11:23:27 GMT-0500 (Eastern Standard Time); _tldtest_v9drpTqncV_ZpHS_60dHQE=1; amplitude_testycombinator.com=MC42NDQwNDY1Mzk1MTE3NDMy; _tldtest_0qYpIUBmMzP95xvF4QHsj2=1; amp_cookie_testCEW3BZMr7LPjLM4x2EU94n=Wed Dec 02 2020 11:23:27 GMT-0500 (Eastern Standard Time); amp_cdb89a=0MXBkVo5ArXwVOwIrLtX81...1eoi482ap.1eoi482ba.0.7.7' \
  --compressed

< HTTP/1.1 400 Bad Request
< Server: nginx
< Date: Wed, 02 Dec 2020 16:26:57 GMT
< Content-Type: text/html
< Content-Length: 644
< Connection: close
<
<html>
<head><title>400 Request Header Or Cookie Too Large</title></head>
<body bgcolor="white">
<center><h1>400 Bad Request</h1></center>
<center>Request Header Or Cookie Too Large</center>
<hr><center>nginx</center>
</body>
</html>

I have also attached the source code for the Intention extension where you can see the key prefixes for the cookies I mentioned above. Apparently I wasn’t able to attach it, I can provide it if needed. Source code here: intention-bundle-formatted-20201202.js.zip

Environment

• JS SDK Version: unknown
• Installation Method: via Chrome extension
• Browser and Version: Version 87.0.4280.67 (Official Build) (x86_64)

[humaknlght]

I am seeing the same issue happening when I enable the HTTPS Everywhere plugin in Chrome

• https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp
• https://github.com/EFForg/https-everywhere

[dkthehuman]

Thanks for tagging me @scottsb! This seems pretty nasty, and I didn’t realize Amplitude was adding cookies for various domains. I definitely don’t want Intention to be breaking sites, so I’m going to push a build now that disables Amplitude for all users until this issue is resolved.

@callado4 The reason why Amplitude requests are sent even though you have uBlock Origin enabled is not because Intention is doing anything nefarious but because extensions can’t affect other extensions for security reasons. (I use uBlock Origin myself and would love to respect that preference, but I can’t detect whether uBlock Origin is installed without requesting additional permissions to manage your extensions which I’d like to avoid.) The problem above should cease once Intention is updated, but in the meantime, you can go to Settings > Privacy > Uncheck “Send usage statistics” to disable Amplitude yourself.