Profile2_regpath.module profile2_regpath_attach_profile_fields function lines 498 - 501:

// Attach custom confirmation message to form for later display.
if (isset($misc['confirmation_display'])) {
  $_SESSION['profile2_regpath']['confirmation_message'] = $misc['confirmation_message'];
}

initializes session variable that is used in profile2_regpath_user_insert for drupal_set_message. Couldn't this be handled by fetching the type in profile2_regpath_user_insert or passed as a hidden value in form?
Creating unnecessary session cookie before user has made any other action than visiting the page invalidates reverse cache proxy result on all other page requests. Saving session cookie without consent is also forbidden in EU.

CommentFileSizeAuthor
#1 check_confirmation_display-1897570-1.patch789 byteskimwes
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

kimwes’s picture

kimwes CreditAttribution: kimwes commented
Status: Active » Needs review
FileSize
check_confirmation_display-1897570-1.patch789 bytes

This can be at least averted by fixing the check above that checks if confirmation_display is set.

grasmash’s picture

grasmash CreditAttribution: grasmash commented
Status: Needs review » Fixed

Thanks! Committed to dev.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

ufku’s picture

ufku CreditAttribution: ufku commented
Issue summary: View changes
Status: Closed (fixed) » Active

This is still active for 7.x-2.x-dev. I think the commit was reverted later.

The unnecessary session cookie is preventing varnish cache in our case.