Login

Chrome 80: Awin increases security by auto upgrading links to HTTPS and supporting HSTS

Written by 2 minute read

Awin is prepared for the release of Chrome 80, are you?

On February 4, Google will release an update to its Chrome browser. As explained in an earlier announcement, Chrome will limit cross-site cookies to HTTPS connections. To ensure continuous tracking during this change, Awin is upgrading security standards and making relevant attribute changes to cookies (ex: adding the SameSite=none attribute and a secure flag as outlined in a recent Chromium blog post.)

Awin has always strongly advocated the use of secure web standards, with 97% of Awin’s traffic using HTTPS. To ensure the remaining 3% of traffic still tracks accordingly, Awin will force HTTPS for all tracking links and introduce support for HTTPS Strict-Transfer-Security protocol (HSTS), which requires and triggers a secure connection for Awin’s tracking code. HSTS will be supported for all compatible browsers. Where HSTS is not compatible with a browser, Awin’s forced redirect to HTTPS will ensure tracking remains intact.

These changes will happen over the next few days and should go unnoticed by users without effecting the existing tracking service.

With the introduction of HSTS and Awin’s forcing of HTTPS, customers are not required to make any specific changes. However, Awin strongly advises that advertisers and publishers use secure protocols and make it the default for all Awin links. Furthermore, publishers should install the Publisher MasterTag and activate the Tracking Optimization plugin, which ensures publishers follow Awin’s linking best practice.

It is also worth noting that, for publishers who are not using the Tracking Optimization Plugin and have HTTP redirects, Awin will add a forced redirect to protect commission. This may result in slight latency due to the use of HSTS.

Alongside the release of Chrome 80, Google has recently announced plans to completely phase out third-party cookies over a two year period. This sees Google follow in the footsteps of Safari and Firefox, however, a welcome difference is the staggered approach that allows for suitable replacement technologies to be found and agreed upon - good news for data-light tracking technology providers and a safeguarding of revenues for publishers (and of course Google). Undoubtedly this will open up further issues and opportunities, something Awin will continue to monitor very closely.

If you have any concerns about the upcoming release of Chrome 80, please speak with your account contact. Awin recommends reading the Chromium blog and using Google’s recommended tools to ensure your sites remain compliant outside of Awin’s tracking and subresources.