Cookie Name

Purpose

Expiry

_Secure-has-sid

Detects a user’s login state in Lightning Web Runtime Eperience (LWR Experience) on the client-side. Set during login to LWR Experience. Never set this cookie to HttpOnly.

Session

52609e00b7ee307e

Browser Fingerprint cookie. Used to detect session security problems.

Session

79eb100099b9a8bf

Browser Fingerprint trigger cookie. Used to detect session security problems.

Session

apex__EmailAddress

Caches contact IDs associated with email addresses.

1 Year

BAYEAX_BROWSER

Identify a unique browser subscribed to CometD streaming channels.

Expired on Creation

BrowserId

Used for security protections.

1 Year

BrowserId_sec

Used for security protections.

1 Year

clientSrc

Used for security protections.

Session

communityId

Cookie set to tie the ideas to a specific Experience Cloud site.

Session

CookieConsent

Used to apply end-user cookie consent preferences. Stores a Boolean for whether user has consented to the cookie policy options offered by the site. Without this cookie, Graphisoft would not be able collect consent from their end- users.

1 Year

CookieConsentPolicy

Used to apply end-user cookie consent preferences set by Graphisoft’s client-side utility.

1 Year

cookieSettingVerified

Used to create a popup message telling users that cookies are required.

Session

cordovaVersion

Used for internal diagnostics with mobile applications.

Session

csssid

Used to establish a request context in the correct tenant org.

Session

csssid_Client

Enables user switching.

Session

devOverrideCsrfToken

Cross-site Request Forgery (CSRF) Token.

Session

disco

Tracks the last user login and active session for bypassing login (For example, OAuth immediate flow).

Session

force-proxy-stream

Ensures that client requests hit the same proxy hosts and are more likely to retrieve content from cache.

3 Hours

force-stream

Used to redirect server requests for sticky sessions.

180 Minutes

guest_uuid_essential_<15-char SiteID>

Provides a unique ID for guest users in Experience Cloud sites. Expires one year after the user’s last visit to the site.

1 Year

idccsrf

Tracks Cross-site Request Forgery (CSFR) validation for certain SSO flows.

Session

inst

Used to redirect requests to an instance when bookmarks and hardcoded URLs send requests to a different instance. This type of redirect can happen after an org migration, a split, or after any URL update.

Session

language

Identifies the language for custom components, surveys, and flows, which support multiple languages. Without this cookie, translations for custom features can appear incorrectly.

Session

lastlist

Used to store the cookie name for the last list URL.

Session

lloopch_loid

Determines whether to send the user to a specific portal login or an app login.

1 Year

oid

Stores the last logged in org for redirecting requests. Used for logging whether the cookie is present in site and community guest-user requests.

1 Year

pctrk

Used to track unique page visitors in Experiences.

1 Year

PicassoLanguage

Used to store a user’s language selection for this Experience Builder site. The site doesn’t load without this cookie if the user changes the site’s language.

Session

promptTestMod

Stores whether test mode is in effect. This cookie is read-only.

30 Days

renderCtx

Used to store site parameters in the session for reuse across requests by a single client for functionality and performance reasons. Metadata required for fetching site pages and components based on pageld, schema, viewType, brandingSet, formFactor, and audience targeting.

Session

RRetURL

Used with 'Log in As' to restore the original state.

Session

RRetURL2

The return URL to redirect to when logging out of a session.

Session

RSID

Session ID and login-as session ID. In this case the cookies are copied to the response and cause the target URL to rebuild appropriately in a proxy situation. The cookies aren't created, examined, or modified.

Session

sfdc_lv2

Stores identity confirmation details for Experience Cloud users. If the cookie isn't set or it expires, users must repeat the identity confirmation process the next time that they log in. Identity confirmation requires a verification method such as SMS, an authenticator app, or a security key.

1 Year

sfdc-stream

Used to maintain a sticky (persistent) session on the http://salesforce.com domain. Makes sure that subsequent streaming requests are forwarded to the same server instance where the streaming subscription request was originally handled.< p>

3 hours

sid

SessionID.

Session

sid_Client

Used to detect and prevent session tampering.

Session

ssostartpage

Identifies the Identity Provider (IdP) location for SSO; certain service provider initiated SSO requests can fail without this cookie.

1 Year

SUCSP

Used when the user identity that an administrator is assuming (via Log in to Experience as User) is a Customer Success Portal (CSP) user.

Session

SUPRM

Used when the user identity that an administrator is assuming (via Log in to Experience as) is a Partner Relationship Management (PRM) portal user.

Session

useStandbyUrl

Controls how quickly to set the standby URL when loading the softphone.

Not Set