Serving Croct requests first-party so privacy blockers stop dropping them
Noticed EasyPrivacy-style blockers silently drop some Croct requests. That skews our data, and honestly it is also the kind of third-party call I would rather not be making at all.
What I want is to route everything through our own domain so it is genuinely first-party. How do people set that up
2 answers
The blockers are matching on the request paths. EasyList and EasyPrivacy rules can catch the evaluate, track, and content endpoints, so they get dropped before they ever leave the browser.
The fix is first-party proxying. Point baseEndpointUrl and cidAssignerEndpointUrl at paths on your own domain, and stand up a thin proxy that forwards to Croct. Once the calls go out to your origin, they are first-party and off the blocker lists entirely. There is a fuller writeup in why ad blockers drop Croct endpoints.
One thing that trips people up right after they do the proxy: remember to allow the proxied origin in your CSP connect-src, otherwise the browser blocks the requests for a different reason and it looks like the proxy is broken. Covered in allowing the first-party proxy origin in CSP connect-src.
The connect-src note saved me, that was exactly the wall I hit after repointing the endpoints. All first-party now and the drop rate is gone