feat(browser): warn when person processing stays suppressed and when an identify ID may not be unique - #4806
Draft
posthog[bot] wants to merge 5 commits into
Conversation
…an identify ID may not be unique With person_profiles: 'identified_only', PostHog creates no person profile until identify(), a group, or an alias enables person processing. A project that never does one of these sees events arrive next to an empty persons table, with no signal from the SDK. Warn once per page load after 50 captured events with person processing suppressed. identify() now also warns when the ID is short and letters only, such as a first name or a username. Two users can share such an ID, and PostHog then merges them into one person. The warning never blocks the call. Generated-By: PostHog Desktop Task-Id: a037bf2a-007c-4075-980a-6a20f3236702
Contributor
Author
🦔 PostHog Review reviewed this pull requestFound 0 must fix, 4 should fix, 0 consider. Published 4 findings (view the review). Resolved comments: 1 fixed, 3 already settled |
Contributor
Contributor
|
Size Change: +15.2 kB (+0.07%) Total Size: 20.5 MB 📦 View Changed
ℹ️ View Unchanged
|
Contributor
posthog-js Compliance ReportDate: 2026-09-05 21:29:20 UTC ✅ All Tests Passed!26/26 tests passed Capture Tests✅ 26/26 tests passed View Details
|
Generated-By: PostHog Desktop Task-Id: a037bf2a-007c-4075-980a-6a20f3236702
The message text was most of the bundle-size increase this pull request reported. The shorter messages keep the cause and every remedy. Generated-By: PostHog Desktop Task-Id: a037bf2a-007c-4075-980a-6a20f3236702
Contributor
Author
|
PostHog Review alpha 🦔 If you find any issues helpful - please reply "valid", "invalid", etc., for evaluation purposes 🙏 |
![posthog[bot]](https://avatars.githubusercontent.com/in/1203049?s=60&v=4){kind=small}
The IDs this warning matches are names or usernames by construction, and the message goes to console.warn, which session replay console capture and external RUM tools record. Drop the interpolated value and keep the actionable advice. Generated-By: PostHog Desktop Task-Id: 73dff66e-ecb6-4960-8d97-38841e009ec8
… apply Print the identify() warning only after _requirePersonProcessing() accepts the call. With person_profiles: 'never' PostHog discards the call, so the merge warning did not apply. Warn once per instance, because an app that identifies on each route change repeated the line on every navigation. Stop the suppressed-person-processing counter once person processing becomes active. Anonymous events captured after a reset() at logout could otherwise add to the events captured before the login and warn a project that identifies correctly. Say that a manual person split can separate merged users, instead of saying that nothing can. Generated-By: PostHog Desktop Task-Id: a037bf2a-007c-4075-980a-6a20f3236702
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
identify()can hit the same trap.person_profilesdefaults toidentified_only, so_hasPersonProcessing()suppresses profile creation untilidentify(), a group, or an alias arrives. The default is correct; the silence is not._validateIdentifyIdrejects only empty values, the cookieless sentinel,"undefined","null", and thedistinct_idstrings. A bare username passes without a word, so two people who share a short ID merge into one person and the person data is corrupted, not just confusing.Changes
person_profiles: 'identified_only', noidentify(), group, or aliasidentify()ID may not be uniquejohn,admin,TestUser)console.warnwith the[PostHog.js]prefix, like the existing consent and volatile-identity warnings, becauselogger.warnis invisible with the normaldebug: falseconfiguration.identify()at login, setperson_profiles: 'always', or setperson_profiles: 'never'to silence it; and for the ID, use a database ID, a UUID, or an email address.reset()at logout cannot add anonymous events to the events captured before the login and warn a project that identifies correctly.$snapshotevents do not count towards the threshold. Session recording sends them on a timer, so they would reach 50 while the user does nothing that a person profile would describe.Test strategy
packages/browser/src/__tests__/identify.test.ts: the threshold boundary (49 events silent, 50 events warn, no repeat), no warning afteridentify(), the 49 events /identify()/reset()/ 100 events sequence, no warning forperson_profilesneveroralways, no warning for$snapshot, warnings forjohn/admin/TestUserwith the ID absent from the message, one warning for repeatedidentify()calls, and no warning for a UUID, a numeric ID, an email address, a prefixed ID, or a long opaque token.tsc.dist/module.jsin a jsdom page: the first warning appeared on event 50 and not on event 49,identify('john')warned and still set the distinct ID, andidentify('018f1f0a-...')was silent.efgh. They now allow the new warning, which shows the warning fires exactly where it should.Risk
A site that captures anonymous traffic on purpose and never identifies now sees one console line per page load.
person_profiles: 'never'removes it, and the message says so.Release info Sub-libraries affected
Libraries affected
Checklist
If releasing new changes
pnpm changesetto generate a changeset file🤖 Agent context
Autonomy: Fully autonomous
vitest,oxlint,oxfmt,tsc, and a jsdom script against the built bundle.identify()ID. Some projects use short IDs on purpose, and blocking would lose events.Created with PostHog Desktop from this inbox report.