Subscriber ID: Verify Numeric Subscriber IDs

[n7studios]

Summary

Verifies numeric subscriber IDs (ck_subscriber_id) before they're used by the "Add a Tag" Page / Post setting and the Custom Content shortcode, and signs the subscriber ID cookie so it can't be changed.

Email links

When a visitor arrives with a numeric ck_subscriber_id, the Plugin now also requires the sh_kit parameter that Kit adds to email links when Automatically append hashed subscriber email to email links is enabled in Kit's Advanced Tracking settings.

The Plugin fetches the subscriber by ID and checks that the SHA-256 hash of their email address matches sh_kit. If it matches, the subscriber ID is used and stored in the cookie. If sh_kit is missing or doesn't match, the subscriber ID is ignored.

Cookie

When a numeric subscriber ID is stored, the Plugin also sets a ck_subscriber_id_signature cookie, a hash of the subscriber ID signed with the site's WordPress salt. On later visits, a numeric subscriber ID in the cookie is only used if its signature matches. Numeric subscriber IDs stored by the Form Builder block are signed in the same way.

Cookies now include the SameSite=Lax attribute, and Secure on HTTPS sites.

Unchanged

• Signed subscriber IDs, used by Member Content, work as before, as they're verified by the API.
• Existing ck_subscriber_id and wordpress_ck_subscriber_id cookies are still set.

Behaviour change

Creators using "Add a Tag" or the Custom Content shortcode must enable both Add subscriber_id parameter in email links and Automatically append hashed subscriber email to email links in Kit. Existing numeric subscriber ID cookies, which aren't signed, are ignored until the subscriber next clicks an email link.

The previous behaviour can be restored with:

add_filter( 'convertkit_subscriber_allow_unverified_id', '__return_true' );

Testing

• SubscriberTest:
  • Numeric subscriber IDs in the cookie are only used with a valid signature.
  • Signed subscriber IDs are still used.
  • The convertkit_subscriber_allow_unverified_id filter permits unverified IDs.
  • sh_kit verification: matching, uppercase and wrong hashes, an empty hash, and a different subscriber ID.
• PageTagCest: existing tests include sh_kit. New tests confirm the subscriber isn't tagged when sh_kit is missing or doesn't match.
• PageShortcodeCustomContentCest: Custom Content isn't displayed with only ck_subscriber_id, and is displayed when sh_kit is included.
• BlockMemberContentLoginTest: uses a signed subscriber ID, as a logged in Member Content subscriber would have.

Checklist

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR (if you're not sure who to assign, we can do this step for you)

[github-actions]

WordPress Playground

🚀 Your PR has been built and is ready for testing in WordPress Playground!

Click here to test your changes in WordPress Playground

[noelherrick]

Let's make sure there's not a mismatch between the lowercasing/downcasing/trimming before we ship.

[github-actions]

WordPress Playground

🚀 Your PR has been built and is ready for testing in WordPress Playground!

Click here to test your changes in WordPress Playground