Handles beacon POSTs from the JS client and client-side click tracking.
Anonymous identity (_ga_anon)
When a request body omits anonymous_id, the controller falls back to the
_ga_anon cookie (see resolve_anonymous_id/2). Treat this cookie as a
weak, client-forgeable identity signal: it is set server-side with
http_only: true + same_site: "Lax" (mitigating XSS theft and CSRF) and
carries a 128-bit random id (infeasible to guess), but it is unsigned, so a
client with direct cookie access can still present an arbitrary value. It is
only ever used as a weak signal for visitor resolution/merging alongside a
fingerprint — never as authorization or for any privileged decision.
Summary
Functions
Handles client-side click tracking (via= param flow).
Receives beacon events from the JS snippet.
Functions
Handles client-side click tracking (via= param flow).
Expected payload:
{
"key": "john",
"fingerprint": "fp_abc",
"url": "https://example.com/pricing?via=john",
"referrer": "https://twitter.com"
}Returns {ga_id: "...", visitor_id: "..."}.
Receives beacon events from the JS snippet.
Expected payload:
{
"event_type": "pageview",
"event_name": "Page View",
"url": "https://example.com/page",
"referrer": "https://google.com",
"fingerprint": "fp_abc",
"ga_id": "click-123",
"event_id": "67c12c6e-117a-4c14-94cb-50f62fb81c4e",
"properties": {}
}