Public pages skip cookie verification detours

Before delivering any page, the system checked whether the browser accepted cookies: it set a cookie, redirected and only then showed the content. The check makes sense before a login. Applied to every public page, it had a side effect.

The problem

The bots that build a link preview, in messengers and social networks, request the address once. They do not keep cookies or follow the round trip. They received the "cookies required" screen, and the shared link came out with no title, no description and no image.

What changed

• Public page: the cookie goes in the response itself. There is no redirect.
• Recognised bots: no cookie and no detour. There are 28 identifiers, across search engines, social networks, messengers and validators.
• Login and protected pages: the full check remains.

None of this makes restricted content public: the change is in how a public page is delivered.

Error pages without tracking

System pages, such as 404, 403 and the cookie screen, no longer load analytics and pixel scripts. An error is not a visit, and counting one as the other distorts the numbers.