Firefox “Bad request” caused by corrupt google tracking cookie

Question

We have an issue on our site whereby some Firefox users are receiving a "Bad Request" message when they visit our site (nothing else, just the words "Bad Request"!)

This would appear to be due to a corrupt google tracking cookie, possibly __utmz (one person delete the google cookies in turn and once that one was removed the site came back to life.)

Our website uses this Javascript google tracking code:

    var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
    document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));

    try {
        var pageTracker = _gat._getTracker("UA-**********");
        pageTracker._trackPageview();
    } catch(err) {}

Occasionally we also use this to create a different pseudo-URL to track in google analytics when a form has been completed:

  pageTracker._trackPageview('{$smarty.const.CONST_PAGE_URL}/complete');

{$smarty.const.CONST_PAGE_URL} is just a bit of template code to output the real, current page url.

Finally, probably not relevant but, for cross tracking in our CRM, we also use Salesforce tracking loaded from https://lct.salesforce.com/sfga.js which is kicked off from Javascript in our page footer like this:

__sfga();

I have had a report of this issue from a user of Firefox 3.5.7 - I don't know about the others (except they were using Firefox). Does anyone know what might cause this and if there is any way to stop/avoid it?

Many thanks - BTW stack overflow rocks I use it often :O)

Ben

Answer 1

We experienced the same problem, but it was due to an email campaign and a "non-standard" character (extended hyphen character) being used in the subject line of the email that was then added into to the utm_term variable, used to access the web site. This was put into the __utmz cookie by Google Analytics on the site. Viewing your cookies using for example Firefox's Web Developer plug-in showed the "bad character".

Answer 2

I've seen this before. I don't know if there's a common cause, but i'll at least explain the cause (and the fix) in the one instance i'm familiar with.

Using third-party ad tracking systems cause a Site's visitors to be passed through redirection URLs--for instance, Atlas Search, DoubleClick, SEM Director, or here 'Salesforce', which i am assuming is analogous, but you'll have to verify that. Redirection URLs can break the GA tracking parameters appended to your landing page URLs.

Suppose your landing page URL was http://www.onlinefun.com/?source=google&medium=ppc&campaign=shoes. When that URL is added to a third-party tracking system for redirection, of course, it becomes the query parameter for the redirect URL, so, something like: http://www.redirectdomain.com?http://www.onlinefun.com/?source=....

This URL now has two '?' in it--a problem because you're only allowed one (or at least you are only allowed one to indicate that a query string follows).

Just as in your Question, the first time i saw the behavior, most browsers were unaffected. I had no idea why not all browsers returned a 400, though we were able to fix the problem. The initial quick fix was to substitute a '#' for the second '?' so at least the URL would process. Clearly, the more stable solution is to use encoded landing-page URLs as described in this w3 schools tutorial.