Login Page Cookies
Cookies are a critical part of web applications.
When you call certain APIs, such as the Login API, cookies may be set. Such cookies are specified in the API documentation.
When you use the hosted login pages, the hosted backend or interact with the APIs, FusionAuth uses cookies to enable functionality.
Domains#
The domain of all cookies is the domain on which the FusionAuth instance is running. You can control the domain FusionAuth uses by setting up a proxy.
In other words, if FusionAuth serves requests at auth.piedpiper.com, it will only set cookies for this value: auth.piedpiper.com. It will never set cookies for .piedpiper.com. The ability to control the domain of the cookie set is an open feature request.
Additionally, most cookies set by FusionAuth will use the SameSite value of Strict or Lax. This is to protect against Cross-Site Request Forgery (CSRF). Practically, it means a browser will block those cookies on a cross-site request unless the browser is navigating to the origin site from an external site, which is something to consider if you intend to access FusionAuth from a different domain using something like an IFRAME.
Cookie List#
Cookies set by the hosted login pages are displayed here for informational purposes only. The name, type and description of each cookie are subject to change.
| Name | Type | Description |
|---|---|---|
access_token | Session | The access token. Set by the login API. |
app.at | Persistent | The access token. Set by the hosted backend. |
app.at_exp | Persistent | The access token expiration. Set by the hosted backend. |
app.idt | Persistent | The Id token. Set by the hosted backend. |
app.pkce_v | Persistent | The PKCE verifier. Set by the hosted backend. |
app.rt | Persistent | The refresh token. Set by the hosted backend. |
fa.bypass-c | Session | Implements security functionality. |
fa.bypass-c.csrf | Session | Implements security functionality. |
federated.csrf | Session | Implements security functionality. |
fusionauth.app.pkce-verifier | Request | Used to support Proof Key for Code Exchange during login. |
fusionauth.csrf | Session | Implements security functionality. |
fusionauth.flash-message | Request | Used to display a message across requests. |
fusionauth.known-device.* | Persistent | Identifies a device known to FusionAuth. More than one cookie may be set. |
fusionauth.li | Session | Used to support post-authentication steps during login. |
fusionauth.locale | Persistent | The locale used to localize the themed pages. |
fusionauth.pkce-verifier | Request | Implements security functionality. |
fusionauth.remember-device | Persistent | Records whether the user wants to remain logged in on this device. |
fusionauth.sso | Persistent | Represents a single sign-on session. |
fusionauth.timezone | Persistent | The configured or approximated timezone used to adjust displayed dates and times. |
fusionauth.trust | Persistent | Allows a MFA challenge to be bypassed during login. |
fusionauth.trust_c | Request | Implements security functionality. |
fusionauth.trust_t | Request | Implements security functionality. |
fusionauth.trusted-device.* | Persistent | Identifies a trusted device. More than one cookie may be set. |
fusionauth.webauthn-reauth.* | Persistent | Records user choices about WebAuthn and passkeys. More than one cookie may be set. |
refresh_token | Persistent | The refresh token when the login API is used. |
saml.csrf | Session | Implements security functionality. |