JustFlows

Documentation is English-only for now. The rest of the site follows your language.

Cookie consent

The first-party Cookie Consent plugin: a categorised banner and preference center, per-category script and embed gating, versioned consent records, and a site cookie registry.

7 min read

Cookie Consent is a first-party plugin (plugins/consent). Activate it from Admin → Extensions to add a categorised consent banner and a preference center to the public site. Logic, storage, and display are all first-party — no IP lookup, no third-party dependency.

Categories and the banner

Consent is split into necessary, preferences, analytics, and marketing. The banner offers accept-all and reject-all with equal weight, with granular toggles in the preference center. The modal is keyboard- and screen-reader-accessible and respects prefers-reduced-motion, and a re-open trigger lets a visitor change their mind later. Every visitor-facing string is stored per site language; the runtime picks the visitor's locale from <html lang>, and translating the banner does not invalidate stored consent.

Design panel

Admin → Extensions → Cookie Consent has a design panel with a live preview: layout (bar, floating box, or blocking modal), placement (top, bottom, or any corner), theme-inherited or explicit colours (validated, applied as CSS custom properties), and panel and button radius and width.

Gating scripts and embeds

  • Tag a script as <script type="text/plain" data-jf-consent="analytics">…</script> and it runs only once that category is granted.
  • Off-site oEmbeds are held behind their category with a per-embed unlock.
  • window.justflowsConsent is a first-party API — the custom-code injector, Analytics, and other plugins call justflowsConsent.allowed(name) before loading anything non-essential.
  • A synchronous analytics.head filter defers the Analytics plugin's Google Tag until analytics consent is granted, without blocking first paint.

Consent records

The plugin stores versioned consent records — policy hash, timestamp, choices, locale, and coarse device — exportable as CSV and erasable per record. Record logging can be turned off entirely: no plugin_data rows are written and no beacon is sent. Best-effort EU-only display uses the visitor's timezone, with no IP lookup.

The cookie registry

Extensions declare every non-essential cookie they set with ctx.cookies.declare({ name, category, purpose }) and read the resolved registry (host plus every active plugin) with ctx.cookies.list(). Operators re-classify any cookie by name in the same screen (GET/PUT /api/cookies). Cookie Consent uses the registry to disclose cookies per category and to expire a category's cookies the moment it is withdrawn; window.justflowsConsent.allowed(name) resolves a single cookie against it.

Note

See Hooks for analytics.head and the cookie registry, and Security for the audit log.