fix(browser): warn when bootstrap silently changes the identity at init - #4793
Draft
posthog[bot] wants to merge 3 commits into
Draft
fix(browser): warn when bootstrap silently changes the identity at init#4793posthog[bot] wants to merge 3 commits into
posthog[bot] wants to merge 3 commits into
Conversation
init() can change the identity from a bootstrap config without any message. It calls identify() when isIdentifiedID is true and the local user is anonymous, and it replaces an identified user with an anonymous bootstrapped ID. Both paths were silent, so a wrong isIdentifiedID flag mints one identified person per browser and nobody sees it. Both paths now print a console warning that is visible with debug off. Generated-By: PostHog Desktop Task-Id: 192afa93-418e-49a9-8e4a-afbd294a7872
Contributor
Author
🦔 PostHog Review reviewed this pull requestFound 0 must fix, 1 should fix, 1 consider. Published 2 findings (view the review). Resolved comments: 1 already settled |
Contributor
Contributor
posthog-js Compliance ReportDate: 2026-09-04 21:00:37 UTC ✅ All Tests Passed!26/26 tests passed Capture Tests✅ 26/26 tests passed View Details
|
Contributor
|
Size Change: +11 kB (+0.05%) Total Size: 20.5 MB 📦 View Changed
ℹ️ View Unchanged
|
Contributor
Author
|
PostHog Review alpha 🦔 If you find any issues helpful - please reply "valid", "invalid", etc., for evaluation purposes 🙏 |
![posthog[bot]](https://avatars.githubusercontent.com/in/1203049?s=60&v=4){kind=small}
…arning The warning said init() "merged the local anonymous ID into" the bootstrapped distinctID. That is false for two supported configurations: with reuseAnonymousId the $identify event omits $anon_distinct_id and the flags handoff is cleared, and with person_profiles: 'never' identify() returns early and captures nothing. The message now states only that init() called identify() with the bootstrapped distinctID, and keeps the advice about stable logged-in IDs unchanged. No behavior change. Generated-By: PostHog Desktop Task-Id: ec1ab3d7-af94-4a9e-ac3f-ecb1208030b4
…ty moved init() sets __loaded before the bootstrap block, so identify() reaches its own guards. It returns early for an ID that _validateIdentifyId rejects, and it returns early when person_profiles is 'never'. The warning printed either way, so a project using identity_distinct_id for flag targeting with person processing off read a warning about one identified person per browser while creating no persons at all. The warning is now gated on the distinct ID actually having become the bootstrapped one. Two regression tests cover the person_profiles: 'never' and invalid-ID paths; both fail without the guard. Generated-By: PostHog Desktop Task-Id: ec1ab3d7-af94-4a9e-ac3f-ecb1208030b4
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
init()can change the identity frombootstrapwithout saying anything, and they only find out days later by counting persons._init()are silent:bootstrap.isIdentifiedIDtrueinit()callsidentify()trueidentity_distinct_idconfig setsisIdentifiedID: truefor the caller, so a project can land on the first row without ever writing the flag. If the bootstrapped ID is new for every browser, every browser mints an identified person that can never merge at login.Changes
console.warnwith the[PostHog.js]prefix, like the existing consent and volatile-identity warnings, becauselogger.warnis invisible with the normaldebug: falseconfiguration.reset()before a new user).BootstrapConfig.isIdentifiedIDthat it is only for a stable ID of a logged-in user.Warnings fire only when the identity actually changes, so a correct setup sees at most one line per user per browser, and nothing on repeat loads.
Release info Sub-libraries affected
Libraries affected
Checklist
If releasing new changes
pnpm changesetto generate a changeset file🤖 Agent context
Autonomy: Fully autonomous
posthog-core-also.test.tsfor both warnings and for the no-noise case (same identified ID bootstrapped on every load). Full browser unit suite and functional tests pass; two failures onmainare unrelated (a test that needsdist/and a persistence-key policy test aboutbrowser-client.ts).dist/array.jsanddebugoff, over four page loads that share persistence: no bootstrap (quiet), identified bootstrap over a local anonymous ID (first warning), anonymous bootstrap over the identified user (second warning), same anonymous bootstrap again (quiet).Considered and rejected
identify()validation). The polluting IDs are random UUIDs, which no heuristic separates from real user IDs, and a behavior change here would break correct integrations.Created with PostHog Desktop from this inbox report.