Skip to main content

Cookie reader

Note

This technique can be used in conjunction with other SSO configuration only or in stand-alone. When used in stand-alone, if the cookie cannot be retrieved from the parent page at the campaign load, the form step will be presented empty to the participant.

Participation flow​

With this technique, the participant must start the campaign being connected/identified on your side (This part is out of Qualifio’s responsibility). If not, the participant will see an empty form displayed.

  • If the participant is already logged in, a cookie containing a token will be dropped by the client and read by Qualifio to retrieve the participant's profile information when they reach the form step.

    • As a result, the logged-in participant doesn’t need to manually enter personal information, since it will already be included in the token.
    • The participant’s profile information will be retrieved, allowing them to continue their journey in the campaign seamlessly.

  • At the form step, Qualifio will require either the 'Client cookie' that contains the JWT with the participant data or an access token to make an API call.

  • The client needs to define a global variable for the cookie and specify how to validate the token signature and its value (JWKS Endpoint, public key, or symmetric key).

Secure token signature validation methods

  • If there is no valid cookie on the page, Qualifio will attempt a fallback SSO by retrieving a valid SSO integration, allowing the participant to be authenticated via the fallback SSO method. It will only work if a second SSO method is set up.
  • The data received will allow Qualifio to prefill the identification form, enabling the participant to continue their journey in the campaign.
  • If none of the above steps are successful, the participant will see the form displayed and will need to fill it manually.
  • After the participant submits the identification form, their profile data will be stored in the campaign's statistics.

Process flow​

Cookie process flow

What are the requirements to set it up?​

As browsers are always more and more strict regarding exchange of data via cookies,

  • Warning: You have to request your website provider to create a dedicated CNAME for the qualifioapp.com player, and this can take time. Once created, you need to create a dedicated subdomain in Qualifio and associate it with the CNAME created. This can take up to 24 hours to validate the certificate.
  • The data connection won’t work in preview mode, as well as when using mini-sites or facebook integration.
  • You have to integrate the campaigns on pages with the same subdomain name as the one used to configure the campaign, in order to allow Qualifio to read the cookie dropped on the parent page. Indeed, it is forbidden to read cookies between objects with different domain names.
  • You need to integrate the iframe using the JS tag, not the HTML tag, because the iframe needs to communicate with the parent page.

Notes​

  • This flow doesn’t work if the integration method used to publish your campaign is the mini-site or the webview.

    Campaign channels

  • Web browsers are more and more strict when it comes to cookies. This means this technique is not one of the most persistent one, as dependent on web browsers’ cookie policy changes.

  • If there is no valid cookie on the page, before the fallback SSO, Qualifio will redirect once to a fallback URL, leading to the login screen of the client so the participant can log in again. The client can then drop a new cookie, which Qualifio can read to prefill the form for the participant.

Cookie process flow

Additional resources​