Subject: Query string parameters (utm_source, gclid, fbclid) are converted into

-- url of the page with the problem -- : hungarianflavours.com/hu
-- HikaShop version -- : 6.6.0
-- Joomla version -- : 6.1.0
-- PHP version -- : 8.3
-- Browser(s) name and version -- : Chrome 150.0.7871.125

Subject: Query string parameters (utm_source, gclid, fbclid) are converted into SEF path segments via redirect – tracking data lost, cookies/session ID leaked into URL
Environment

• Joomla 6.1.0, HikaShop [VERSION]
• PHP 8.3 (CGI/FastCGI), Apache behind nginx
• Joomla SEF + URL rewriting enabled, multilingual site (Language Filter, URL prefix
  Code:

  /hu
  )
• HikaShop: "Remove products and categories id in URLs" = Yes, "Force canonical URLs on listings" = "Use canonical URL and generate it if missing", category SEF name =
  Code:

  kategoria

Steps to reproduce

1. Open any HikaShop page with any query string parameter, e.g.:
   • Code:

     https://hungarianflavours.com/hu/webaruhaz/bio-ceklale?utm_source=facebook
   • Code:

     https://hungarianflavours.com/hu/webaruhaz/kategoria/gyumolcslevek?gclid=abc
   • Code:

     https://hungarianflavours.com/hu/webaruhaz?utm_source=x
     (menu item of the main category listing)
2. HikaShop immediately redirects to a URL where every request variable is appended as a path segment:
   • Code:

     /hu/webaruhaz/bio-ceklale/utm_source-facebook
   • Code:

     /hu/webaruhaz/utm_source-x
     → 404 on the main shop listing
   • Code:

     /hu/webaruhaz/kosar?utm_source=x
     →
     Code:

     /hu/webaruhaz/kosar/view-category/layout-listing/utm_source-x
     → 404

Joomla com_content pages on the same site keep the query string and do not redirect, so the behaviour is HikaShop-specific.
Additional finding (security)
On our server was empty, so also contained cookies. Because of this, the redirect URL contained all cookie values, including the session cookie, e.g.:

This means a visitor's session ID ends up in the address bar, in shared links and in analytics. We have set as a workaround, but HikaShop should not build redirect URLs from (cookies) at all.
Impact

• Google Ads auto-tagging (
  Code:

  gclid
  ,
  Code:

  gbraid
  ,
  Code:

  wbraid
  ), Facebook
  Code:

  fbclid
  and UTM parameters are removed from the query string before the page loads, so Google Ads / GA4 conversion attribution and campaign tracking do not work for shop pages.
• 404 errors for ad and social clicks landing on the main shop listing and on the cart.
• Duplicate URLs (
  Code:

  /product/utm_source-xxx
  ) that can get crawled.

Expected behaviour
Unknown or third-party query parameters (at least , , , , , , , ) should be left in the query string, with no redirect. Cookie values must never be used to build URLs.
Question
Which code or setting triggers this "redirect to SEF URL with all request vars"? Is there a configuration option to disable it, or to whitelist or ignore tracking parameters? A patch or a pointer to the responsible file would be very welcome.
Current workaround on our side
An rule that 301-redirects any URL containing a tracking segment ( , , ) to the clean URL. This prevents the 404s, but the tracking data is still lost.

Hi,

The redirect comes from the "Strict routing" option of Joomla's "System - SEF" plugin (added in Joomla 5.2). On a page opened with a query string, Joomla rebuilds the URL from all the request variables and redirects to it when the rebuilt URL has no query string left. HikaShop's router turns any variable it doesn't know into a path segment (name-value), so utm_source, gclid, fbclid, etc. were moved into the path and the query string was lost. Joomla takes these variables from $_REQUEST, which is why the cookies ended up in the URL when PHP's request_order was empty.

We have corrected HikaShop's router: tracking parameters (utm_*, gclid, gbraid, wbraid, fbclid, msclkid, _gl, srsltid, and other common ones such as mtm_*, pk_*, dclid, ttclid, mc_cid) now stay in the query string, so Joomla no longer redirects, and a variable that only comes from a cookie is never put in a URL anymore. The fix is in front/router.php (components/com_hikashop/router.php on your site) and is included in a new HikaShop build.

Until you update, you can go to Extensions > Plugins > "System - SEF" and set "Strict routing" to No: the redirect will stop and the tracking parameters will stay in the URL. Keeping request_order = "GP" in PHP is also the right setting. But you can just download the new build of HikaShop on our website and install it on your website in order to get the modifications for this to be handled properly by HikaShop's router.