DEP-12299 Start.io Bid Adapter: enable withCredentials on bid request to forward siouid cookie

[IlliaMil]

No description provided.

[greptile-apps]

Greptile Summary

This PR enables withCredentials: true on outbound bid requests in the Start.io adapter so the browser forwards the siouid cookie to pbc-rtb.startappnetwork.com, improving user identity matching.

• The change is a single boolean flip in buildRequests; no other logic was modified.
• withCredentials is now hardcoded to true with no conditional check on GDPR or US-privacy consent state, meaning the cookie is sent on every auction regardless of whether the user has given a lawful basis for Start.io (GVLID 1216) to process their data.

Confidence Score: 3/5

The change forwards a user-identifying cookie on every bid request without checking whether the user has consented; merging as-is risks non-compliant cookie transmission in GDPR-regulated contexts.

The adapter now always sends the siouid cookie cross-origin regardless of GDPR or CCPA consent status. Every auction in a regulated region would transmit the cookie without a lawful basis, which is the core purpose of the change but lacks the standard Prebid consent guard that other adapters use for the same pattern.

modules/startioBidAdapter.js — specifically the buildRequests function where withCredentials is set without any consent check.

Security Review

• Cookie forwarding without consent gate (modules/startioBidAdapter.js): withCredentials: true sends the siouid user-identifying cookie to Start.io on every bid request, including when GDPR applies and the user has not provided consent for this vendor. This bypasses TCF-compliant data processing requirements and may constitute unlawful processing of personal data under GDPR Article 6.

Important Files Changed

Filename	Overview
modules/startioBidAdapter.js	Single-line change flipping withCredentials from false to true; no consent guard added, so the siouid cookie is forwarded on every bid request regardless of GDPR/CCPA state.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant PrebidJS as Prebid.js (startioBidAdapter)
    participant RTB as pbc-rtb.startappnetwork.com

    Browser->>PrebidJS: auction triggered
    Note over PrebidJS: buildRequests()<br/>withCredentials: true (changed)
    PrebidJS->>RTB: "POST /1.3/2.5/getbid?account=pbc<br/>+ siouid cookie (now forwarded)"
    RTB-->>PrebidJS: bid response (seatbid[])
    PrebidJS-->>Browser: interpreted bids

    Note over Browser,RTB: withCredentials=true requires server to respond<br/>with Access-Control-Allow-Credentials: true<br/>and a specific Access-Control-Allow-Origin (not *)

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
modules/startioBidAdapter.js:128-131
**`withCredentials` set unconditionally regardless of consent**

`withCredentials: true` is applied to every bid request with no check on `bidderRequest.gdprConsent` or `bidderRequest.uspConsent`. This means the `siouid` cookie is forwarded even when GDPR applies and the user has not consented to Start.io (GVLID 1216), which can violate the TCF requirement that vendors only process user data after receiving a lawful basis. The standard Prebid pattern is to gate `withCredentials` on consent, for example: `withCredentials: !bidderRequest.gdprConsent?.gdprApplies || !!bidderRequest.gdprConsent?.consentString`.

_{Reviews (1): Last reviewed commit: "Enable credentials in StartIO bid adapte..." | Re-trigger Greptile}