Hosted Login Pages Cookies
Overview
Cookies are a critical part of web applications.
When you call certain APIs, such as the Login API, cookies may be set. Such cookies are specified in the API documentation.
When you use the hosted login pages, FusionAuth uses cookies to enable functionality.
Domains
The domain of all cookies is the domain on which the FusionAuth instance is running. You can control the domain FusionAuth uses by setting up a proxy.
In other words, if FusionAuth serves requests at auth.piedpiper.com, it will only set cookies for this value: auth.piedpiper.com. It will never set cookies for .piedpiper.com. The ability to control the domain of the cookie set is an open feature request.
Additionally, most cookies set by FusionAuth will use the SameSite value of Strict or Lax. This is to protect against Cross-Site Request Forgery (CSRF). Practically, it means a browser will block those cookies on a cross-site request unless the browser is navigating to the origin site from an external site, which is something to consider if you intend to access FusionAuth from a different domain using something like an IFRAME.
Cookie List
Cookies set by the hosted login pages are displayed here for informational purposes only. The name, type and description of each cookie are subject to change.
Hosted Login Page Cookies
| Name | Type | Description |
|---|---|---|
fusionauth.flash-message | Request | Used to display a message across requests. |
fusionauth.known-device.* | Persistent | Identifies a device known to FusionAuth. More than one cookie may be set. |
fusionauth.li | Persistent | Used to support post-authentication steps during login. |
fusionauth.locale | Persistent | The locale used to localize the themed pages. |
fusionauth.pkce-verifier | Request | Used to support Proof Key for Code Exchange during login. |
fusionauth.remember-device | Persistent | Records if the user wants to remain logged in on this device. |
fusionauth.sso | Persistent | Represents a single sign-on session. |
fusionauth.timezone | Persistent | The configured or approximated timezone used to adjust displayed dates and times. |
fusionauth.trusted-device.* | Persistent | Identifies a trusted device. More than one cookie may be set. |
fusionauth.trust_c | Request | Implements security functionality. |
fusionauth.trust_t | Request | Implements security functionality. |
fusionauth.trust | Persistent | Allows a 2FA challenge to be bypassed during login. |
fusionauth.webauthn-reauth.* | Persistent | Records user choices about WebAuthn and passkeys. |