# Income Access & KingBilly

## 1. Postbacks issue
Problem: Affiliates don’t get registration & Sales postbacks
### Scenario:
- I setup campaing for an affiliate (some AD network)
- The Affiliate provide Us Pixels to trigger event on user registration and first deposit
- I add those links into the Event Subscription of the Affiliate Program
- I expect: Every player registered by the campaign url player will result in postback from the IA side that should contain additional parameters such as click ID and user ID
- I have: none of the events triggered

### Under the hood

User->IA Tracker: user click on aff link
IA Tracker-> KBC site: user recives IA cookies
KBC site -> Cloudflare: copies user cookies
Note left of Cloudflare: Also CF makes 
Note left of Cloudflare: currecncy converison
Cloudflare -> IA Tracker: send postback with userid and IA cookies
Note left of IA Tracker: nothing happens here

We have proof that CF fires postbacks with cookies and userids for registration, and also fires postback for deposits with deposit amount.
IA confirmed that they do receive postbacks, but they are not shown in the internal IA event feed.

### Possible solutions:
We need an additional assistance from IA to setup at least one working link with both registration and sales pixel working.

## 2. GEO tracking IE
Problem: geo restrictions in campaings not working.
### Scenario:
- I set up new camapaign, CPA per registration
- I set up campaign properties to block visitors from Poland etc.
- I share link to an affiliate
- I expect: visitors from Poland will be blocked, only 1st tier countries will be counted in CPA cost
- I have: visitors from Poland landed to my site with affiliate code. They qualified like correct registration.

### Under the hood:
Geo IP function in IA is broken. An aff link visitor country detects wrong GEO.
It happens because of CloudFlare flexible SSL proxy in front of IA backend. IA backend detects CF ip, instead of user ip. We can't disable CF flexible SSL because IA doesn't support SSL on their domain.

### Possible solutions:
1. IA installs LetsEncrypt certbot and creates SSL certificate for tracking domain themself. We can't do that from our side, IA have to create a file on http server and feed it to LE server for validation.
2. According to the collected info problem that was caused by Cloudflare has roots in ignoring `x-forwarded-for` header on IA server side. Redirection links are working, but IA logs CF ip addresses, which are proxy IP. That's why geo ip filter was broken.
IA was offered to check an article [Restoring-original-visitor-IPs](https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs-Logging-visitor-IP-addresses-with-mod-cloudflare-)
`x-forwarded-for` is a standard header. If we proxy IA using traffic or similar proxy for adding SSL on top of http we will have a similar issue. It's not limited to Cloudflare, but will exist with any proxy setup.
3. As another option LE allows to create wildcard domain certificate, like *.kingbillycasino.com. For that one DNS verification needs to be used. LE wildcard certificate validity period is 3 month. We can do it, BUT then we will need to pass IA a certificate that covers any of our domains. Which is not Ok for security reasons. Also IA proposed manual update of those certificates each month or two. We can automate cert generation and delivery to the IA team, but from their side it still will be manual process (if something goes wrong partner links will not be working)

In conclusion, available solutions ordered from best to worst:
1. IA will fix detecting original user ip from `x-forwarded-for` header
2. IA will implement certbot at tracking web server
3. If IA refuses to provide any of those fixes we need to measure security risks of providing wildcard cert to IA (which is surely not Ok) and can fallback to manual certificate updates for them