Cookie security

On successful authentication, the Corbado Frontend API sets the following cookies:

TypeNameValuePathAttributesDefault duration
Short-term sessioncbo_short_sessionJWTApplication URLsecure sameSite=lax5 mins
Long-term sessioncbo_long_sessionSession ID (opaque string)Frontend APIhttpOnly secure sameSite=lax1 day

Both the short-term session (represented as JWT) and the long-term session (represented as session ID with database entry) cookies are set with the secure flag, which ensures that they can only be accessed on secure internet connections.

The properties of httpOnly and sameSite will be explained in the following sections on XSS protection and CSRF protection, respectively. These sections provide further details on how these properties contribute to safeguarding against specific types of attacks.

According to GDPR, users are not required to give explicit consent for your application to use session cookies. Session cookies are considered essential cookies, not tracking cookies.

By default, the cookies are not set as wildcard cookies (e.g., * This ensures that, for example, they are not sent to external CDN hosts (e.g., Avoiding wildcard cookies is considered a good practice.