{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/testpilot/issues/1725","repository_url":"https://api.github.com/repos/mozilla/testpilot","labels_url":"https://api.github.com/repos/mozilla/testpilot/issues/1725/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/testpilot/issues/1725/comments","events_url":"https://api.github.com/repos/mozilla/testpilot/issues/1725/events","html_url":"https://github.com/mozilla/testpilot/pull/1725","id":186673510,"number":1725,"title":"[fixes #904] Add Optimizely","user":{"login":"ckprice","id":8632184,"avatar_url":"https://avatars.githubusercontent.com/u/8632184?v=3","gravatar_id":"","url":"https://api.github.com/users/ckprice","html_url":"https://github.com/ckprice","followers_url":"https://api.github.com/users/ckprice/followers","following_url":"https://api.github.com/users/ckprice/following{/other_user}","gists_url":"https://api.github.com/users/ckprice/gists{/gist_id}","starred_url":"https://api.github.com/users/ckprice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckprice/subscriptions","organizations_url":"https://api.github.com/users/ckprice/orgs","repos_url":"https://api.github.com/users/ckprice/repos","events_url":"https://api.github.com/users/ckprice/events{/privacy}","received_events_url":"https://api.github.com/users/ckprice/received_events","type":"User","site_admin":false},"labels":[{"id":253958633,"url":"https://api.github.com/repos/mozilla/testpilot/labels/status:%20in%20progress","name":"status: in progress","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2016-11-01T23:15:40Z","updated_at":"2016-11-04T16:31:09Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mozilla/testpilot/pulls/1725","html_url":"https://github.com/mozilla/testpilot/pull/1725","diff_url":"https://github.com/mozilla/testpilot/pull/1725.diff","patch_url":"https://github.com/mozilla/testpilot/pull/1725.patch"},"body":"This PR does ~~two~~ three things - one optional, two required - for Optimizely integration (in addition to adding the code snippet)\r\n\r\n(1) Set JavaScript variables to explicitly set the current page state ([optional:ref](https://help.optimizely.com/Build_Campaigns_and_Experiments/AngularJS,_Backbone.js,_React,_and_Single_Page_Applications_in_Optimizely_Classic#1._Identify_states_in_your_Single_Page_App)).\r\n\r\nAs noted in the docs, we can scrape the page's DOM elements to determine page state in lieu of setting these variables. For instance, in the Optimizely dashboard, if our targeting has `document.getElementById('feedback-button')` we would know that the page state is most likely an experiment page.\r\n\r\nThe environment variables give us a pretty certain way to determine page state now and going forward. But again, this is optional, so I would welcome input here on removing. There may be another way we can determine this that I missed.\r\n\r\n(2) Send a custom event to Optimizely when things happen on the page ([required:ref](https://help.optimizely.com/Build_Campaigns_and_Experiments/AngularJS,_Backbone.js,_React,_and_Single_Page_Applications_in_Optimizely_Classic#3._Use_Custom_Event_Goals)).\r\n\r\nPiggy-backing on the `sendToGA` function used for event tracking seemed like the best way to go.\r\n\r\n(3) Update CSP to give Optimizely framing rights ([required:ref](https://help.optimizely.com/Troubleshoot_Problems/Update_your_site's_Content_Security_Policies_(CSP))).\r\n\r\n(this one got a bit sticky)\r\n\r\nUpdated the prod/stage CSP rule to include the `frame-src` directive and add Optimizely.\r\n\r\nUpdated the dev CSP rule to include Optimizely in the `frame-src` directive.\r\n\r\nI removed the `X-FRAME-OPTION` header because 1. [it looks to be deprecated](https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Preventing_Clickjacking), and 2. multiple URLs aren't fully supported.\r\n\r\nIt seems as though the `frame-ancestors` directive is the preferred way to add this, but there's a note that you can't use it in a `<meta>` tag, which - from what I gathered [in `deploy.sh`](https://github.com/mozilla/testpilot/blob/master/bin/deploy.sh#L72) - is what we are doing. If it's not, I can update this to use `frame-ancestors` instead.\r\n\r\n@clouserw noted you can't test this stuff locally so I couldn't verify that this change made the Optimizely dashboard work, but we can in dev. Very much open to opinions here as I haven't done much CSP stuff before.\r\n\r\nFixes #904.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/mozilla/testpilot/issues/comments/258480483","html_url":"https://github.com/mozilla/testpilot/pull/1725#issuecomment-258480483","issue_url":"https://api.github.com/repos/mozilla/testpilot/issues/1725","id":258480483,"user":{"login":"ckprice","id":8632184,"avatar_url":"https://avatars.githubusercontent.com/u/8632184?v=3","gravatar_id":"","url":"https://api.github.com/users/ckprice","html_url":"https://github.com/ckprice","followers_url":"https://api.github.com/users/ckprice/followers","following_url":"https://api.github.com/users/ckprice/following{/other_user}","gists_url":"https://api.github.com/users/ckprice/gists{/gist_id}","starred_url":"https://api.github.com/users/ckprice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ckprice/subscriptions","organizations_url":"https://api.github.com/users/ckprice/orgs","repos_url":"https://api.github.com/users/ckprice/repos","events_url":"https://api.github.com/users/ckprice/events{/privacy}","received_events_url":"https://api.github.com/users/ckprice/received_events","type":"User","site_admin":false},"created_at":"2016-11-04T16:31:09Z","updated_at":"2016-11-04T16:31:09Z","body":"Let's not land this this sprint, and spend some time making sure the CSP stuff is good on dev."}}
{"actor":{"display_login":"ckprice"}}