Hosted Login Pages Cookies

    Overview

    Cookies are a critical part of web applications.

    When you call certain APIs, such as the Login API, cookies may be set. Such cookies are specified in the API documentation.

    When you use the hosted login pages, FusionAuth uses cookies to enable functionality.

    Domains

    The domain of all cookies is the domain on which the FusionAuth instance is running. You can control the domain FusionAuth uses by setting up a proxy.

    In other words, if FusionAuth serves requests at auth.piedpiper.com, it will only set cookies for this value: auth.piedpiper.com. It will never set cookies for .piedpiper.com. The ability to control the domain of the cookie set is an open feature request.

    Cookies set by the hosted login pages are displayed here for informational purposes only. The name, type and description of each cookie are subject to change.

    Table 1. Hosted Login Page Cookies
    Name Type Description

    fusionauth.flash-message

    Request

    Used to display a message across requests.

    fusionauth.known-device.*

    Persistent

    Identifies a device known to FusionAuth. More than one cookie may be set.

    fusionauth.locale

    Persistent

    The locale used to localize the themed pages.

    fusionauth.pkce-verifier

    Request

    Used to support Proof Key for Code Exchange during login.

    fusionauth.remember-device

    Persistent

    Records if the user wants to remain logged in on this device.

    fusionauth.sso

    Persistent

    Represents a single sign-on session.

    fusionauth.timezone

    Persistent

    The configured or approximated timezone used to adjust displayed dates and times.

    fusionauth.trusted-device.*

    Persistent

    Identifies a trusted device. More than one cookie may be set.

    fusionauth.trust_c

    Request

    Implements security functionality.

    fusionauth.trust_t

    Request

    Implements security functionality.

    fusionauth.trust

    Persistent

    Allows a 2FA challenge to be bypassed during login.

    fusionauth.webauthn-reauth.*

    Persistent

    Records user choices about WebAuthn and passkeys.

    Feedback

    How helpful was this page?

    See a problem?

    File an issue in our docs repo

    Have a question or comment to share?

    Visit the FusionAuth community forum.