ID Resolution
for publishers that exclusively want to transmit PAIR identifiers to bidders. +ois: true the SDK stores the ID and replays it on the X-Optable-OID header,
+ so the same identity survives where the third-party OPTABLE_OID cookie is blocked.
+ ID Resolution
for publishers that exclusively want to transmit PAIR identifiers to bidders. +ois: true the SDK stores the ID and replays it on the X-Optable-OID header,
+ so the same identity survives where the third-party OPTABLE_OID cookie is blocked.
+
+
+
+
+
+
diff --git a/demos/vanilla/ois.html.tpl b/demos/vanilla/ois.html.tpl
new file mode 100644
index 00000000..f635020c
--- /dev/null
+++ b/demos/vanilla/ois.html.tpl
@@ -0,0 +1,261 @@
+
+
+
+
+
+
+
+
+ 
+
+
+
+ +
+
+
+
+
+ Example: Optable Identity System (OIS) using LocalStorage
++ An OIS-enabled DCN recognizes a browser two ways, and only one of them involves the SDK. This page shows + both. See the + OIS section of the README + for the full description. +
+
+
+
+
+
+ 1. Cookie identity — nothing to do
+
+ The browser attaches OPTABLE_OID on its own, so identify, profile and
+ targeting are already attributed to it. It is HttpOnly, so there is deliberately
+ nothing to display here. Block third-party cookies and the DCN falls back to the identity below.
+
+
+
+
+
+
+ 2. Derived identity — stored and replayed by the SDK
+
+ Derived from the device signals below and returned on the X-Optable-OID response header. With
+ ois: true the SDK stores it and replays it on that header. It arrives on the first
+ identify, targeting or profile call — not during
+ initialization.
+
+ Blank after a call? The DCN only derives this identity when ID derivation is enabled for the node
+ and the request comes from a residential IP — a VPN, datacenter or office IP returns no
+ header. It also requires the DCN to expose X-Optable-OID to the browser.
+
+
+
+
+
+
+
+
+
+
+ Forwarded device signals (
+
+
+ Forwarded device signals (sig)
+
+ What forwardSignals: true sends, and what the identity above is derived from. A signal this
+ browser does not expose is omitted rather than sent empty.
+
+
+
+
+
+
+ Call log
+ +
+
+
+
+
+
diff --git a/lib/config.ts b/lib/config.ts
index 864f6514..13ac184c 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -69,6 +69,9 @@ type InitConfig = {
// Forward soft device/browser signals in the 'sig' param. Opt in; also
// requires device access consent.
forwardSignals?: boolean;
+ // Participate in the Optable Identity System (OIS). Opt in; requires an
+ // OIS-enabled node and device access consent.
+ ois?: boolean;
// Timeout hint for API calls (must include unit, e.g. '100ms', '2s', '1m')
// When provided, the server will attempt to answer within the given time limit.
// Some APIs like targeting may return partial responses depending at which stage the timeout occurred.
@@ -111,6 +114,7 @@ type ResolvedConfig = {
abTests?: ABTestConfig[];
additionalTargetingSignals?: TargetingSignals;
forwardSignals?: boolean;
+ ois?: boolean;
timeout?: string;
insecure?: boolean;
};
@@ -149,6 +153,7 @@ function getConfig(init: InitConfig): ResolvedConfig {
abTests: init.abTests,
additionalTargetingSignals: init.additionalTargetingSignals,
forwardSignals: init.forwardSignals,
+ ois: init.ois,
timeout: init.timeout,
insecure: init.insecure,
};
diff --git a/lib/core/network.ts b/lib/core/network.ts
index 50934e63..02be9fd3 100644
--- a/lib/core/network.ts
+++ b/lib/core/network.ts
@@ -2,6 +2,7 @@ import type { ResolvedConfig } from "../config";
import { default as buildInfo } from "../build.json";
import { LocalStorage } from "./storage";
import { deviceSignals } from "./signals";
+import { oisHeaderName, oisRequestID, readOISHeader } from "./ois";
function buildRequest(path: string, config: ResolvedConfig, init?: RequestInit): Request {
const { host, cookies, insecure } = config;
@@ -64,10 +65,20 @@ function buildRequest(path: string, config: ResolvedConfig, init?: RequestInit):
const requestInit: RequestInit = { ...init };
requestInit.credentials = config.consent.deviceAccess ? "include" : "omit";
+ const headers = new Headers(requestInit.headers);
+ requestInit.headers = headers;
if (config.mockedIP) {
- requestInit.headers = new Headers(requestInit.headers);
- requestInit.headers.set("X-Forwarded-For", config.mockedIP);
+ headers.set("X-Forwarded-For", config.mockedIP);
+ }
+
+ // Replay the stored id so the node recognizes this browser instead of deriving
+ // a new one. The OPTABLE_OID cookie is separate and rides along on its own.
+ if (config.ois) {
+ const oisID = oisRequestID(config, url.pathname);
+ if (oisID) {
+ headers.set(oisHeaderName, oisID);
+ }
}
const request = new Request(url.toString(), requestInit);
@@ -76,7 +87,8 @@ function buildRequest(path: string, config: ResolvedConfig, init?: RequestInit):
}
async function fetch
+
+
+
+
+
+
+
+ +
+
+
+
+
+ Example: Optable Identity System (OIS) using cookies
++ An OIS-enabled DCN recognizes a browser two ways, and only one of them involves the SDK. This page shows + both. See the + OIS section of the README + for the full description. +
+
+
+
+
+
+ 1. Cookie identity — nothing to do
+
+ The browser attaches OPTABLE_OID on its own, so identify, profile and
+ targeting are already attributed to it. It is HttpOnly, so there is deliberately
+ nothing to display here. Block third-party cookies and the DCN falls back to the identity below.
+
+
+
+
+
+
+ 2. Derived identity — stored and replayed by the SDK
+
+ Derived from the device signals below and returned on the X-Optable-OID response header. With
+ ois: true the SDK stores it and replays it on that header. It arrives on the first
+ identify, targeting or profile call — not during
+ initialization.
+
+ Blank after a call? The DCN only derives this identity when ID derivation is enabled for the node
+ and the request comes from a residential IP — a VPN, datacenter or office IP returns no
+ header. It also requires the DCN to expose X-Optable-OID to the browser.
+
+
+
+
+
+
+
+
+
+
+ Forwarded device signals (
+
+
+ Forwarded device signals (sig)
+
+ What forwardSignals: true sends, and what the identity above is derived from. A signal this
+ browser does not expose is omitted rather than sent empty.
+
+
+
+
+
+
+