On Jetpack-connected self-hosted sites, viewing posts and sites within the app incorrectly counts as a viewing stat

[guarani]

Expected behavior

On Jetpack-connected self-hosted sites, the app's webviews should show a logged in (authenticated) version of the page/post/site that was opened.

Actual behavior

On Jetpack-connected self-hosted sites, the app's webviews show a logged out version of the page/post/site that was opened.

The major issue this causes for users is that every time they open these logged out web views, the app counts that as a "viewing stat", which pollutes there site statistics which should only count site visitors excluding the site owner.

Steps to reproduce the behavior

1. Log in to WPiOS using a WP.com account and choose a Jetpack-connected self-hosted site
2. Open the following screens and notice that they are all logged out

• Site → View Site
• Site → Posts (or Pages) → Published → View
• Reader → Following:
  • Tap the ellipsis menu (°°°) on a post → Visit
  • Tap the site title on the cell → on the new screen tap the ellipsis menu (°°°) on a post → Visit
  • Tap the post title on the cell → on the new screen tap the ellipsis menu (°°°) → Visit
• Possibly other places like web views that are shown when the user interacts with notifications

Additional information

First reported by users in https://github.com/wordpress-mobile/WordPress-iOS/issues/15296#issuecomment-727842323, and although https://github.com/wordpress-mobile/WordPress-iOS/pull/15309 fixes this for Simple and Atomic sites, Jetpack-connected self-hosted sites still have this issue.

Tested on iPhone 11, iOS 14, WPiOS https://github.com/wordpress-mobile/WordPress-iOS/pull/15309/commits/8e7177562daab7dab5886fb16b59e9fadf9be7c8 (which will land in WPiOS 16.3)

[startuptester]

Moved to Groundskeeping for WPiOS Dec 14-18 rotation

[reginabally]

Another report in 3833083-zd-woothemes. Reproduced through SSP on iPhone SE, iOS 14.4, WPiOS 16.9.

[chipsnyder]

Tested this via 17.0 on a self-hosted Jetpack site and I wasn't able to reproduce it. Including a specific action to logout in the webview. But seeing the user report it seemed like there might be a repro step I didn't find.

[guarani]

👋 Hi @chipsnyder, I just tested this again on the 17.0 beta and was still able to reproduce. Here are the steps I took today to reproduce, please let me know if this helps or if the bug is still not appearing.

1. I created a new self-hosted site, installed Jetpack and connected it to a WP.com account
2. I logged into WPiOS using this WP.com account and located the self-hosted site
3. I went to My Site → Stats, under the Insights tab, I noted the view count under the LATEST POST SUMMARY (4) as well as the Views count under the TODAY section (9)
4. I navigated back to the main My Sites screen and tapped View Site
5. The site is configured to show the latest post on the homepage, so I tapped its title to navigate to the latest post itself (all within the webview)
6. I closed the web view (cross icon button)
7. I went to My Site → Stats, under the Insights tab, I noted the view count under the LATEST POST SUMMARY is still 4 but the Views count under the TODAY section is now 10
8. Doing this a couple more times (steps 4-7) and the view count under the LATEST POST SUMMARY increases till 5

I'm not sure why the count under LATEST POST SUMMARY in stats updates inconsistently or sometimes takes a minute or so to update, but that might be the reason you're not seeing this issue. I also have to pull-to-refresh the stats screen to get the stats to refresh sometimes, that might also be a factor.

[guarani]

Noting that while this issue is specific to Jetpack-connected self-hosted sites, I can also reproduce this on regular WP.com sites as well.

[staskus]

Noting that while this issue is specific to Jetpack-connected self-hosted sites, I can also reproduce this on regular WP.com sites as well.

Yesterday, after initially connecting the self-hosted site to a WPCOM account, both sites were shown as logged in (authenticated).

However, the next day neither self-hosted nor regular WP.com sites were shown as logged in (authenticated). When I added one more self-hosted site, that site was shown as logged in but others still weren't.

[sla8c]

I've taken a deep dive into this and can confirm that this issue occurred for me and I can also confirm that Android has the same issue as well (cc @irfano and @ravishanker). I've also checked global search but cannot find anything meaningful or a project thread or relevant issues or PRs

I think this will need someone from the web team to help understand what cookies need to be set as I think this has probably changed over time on the web platform and not sync'd up with the mobile platforms

What I've done:

• tested using all the test steps
• Dug into the iOS code and I can see where the cookies are being set
• I can confirm that when I launch the web view, the cookies being set from the iOS app show me as logged in
• I've compared the cookies being set on iOS vs web using a web inspector for the following platform scenarios below.
  • web vs iOS for self-hosted websites

• web vs iOS for public-api.wordpress.com

• web vs iOS for widgets for completeness

[guarani]

Thanks for sharing your findings, @sla8c!

Do you know what widgets.wp.com refer to in the web inspector for iOS portion of the last screenshot? Are these web-based widgets or something to do with our iOS Home Screen widgets?

[sla8c]

@Guarani I didn't dig too closely into widgets.wp.com since there were not any disparities; I just noticed that in iOS when you click through to the WebView it was a domain that was requested too -- I think it is most likely a web based widget.

[csabarakasz]

new user report here: 6050489-zd-woothemes

The weird thing is that this site is not self-hosted, but WordPress.com on a Premium plan.

[guarani]

Also reported in p1681191694476599-slack-C04HB8JU78A (sharing here so we can go back and let users know when this is fixed)

[caitlindawn]

Reported in 7653679-zen. Site is WPCOM on the Starter plan.