Skip to content

Commit 1aa6fa9

Browse files
deadlypants1973deadlypants1973
committed
update to add CF_device
1 parent ef22b1b commit 1aa6fa9

File tree

1 file changed

+10
-9
lines changed

1 file changed

+10
-9
lines changed

‎src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,16 @@ If the Access application has more than five domains, Access will not preemptive
3232

3333
## Access cookies
3434

35-
The following Access cookies are essential to Access functionality. These cookies are not used for tracking or analytics.
36-
37-
| Cookie | Details | Expiration | HttpOnly | SameSite | Required? |
38-
| ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | ---------------------------- | --------- |
39-
| [CF_Authorization](/cloudflare-one/identity/authorization-cookie/#access-jwts) (team domain) | [JSON web token (JWT)](https://www.cloudflare.com/learning/access-management/token-based-authentication/) set on the `cloudflareaccess.com` [team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name) that contains the user's identity ands enables Access to perform single sign-on (SSO) | If [global session duration](/cloudflare-one/identity/users/session-management/#global-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Yes | None | Yes |
40-
| [CF_Authorization](/cloudflare-one/identity/authorization-cookie/#access-jwts) (Access application domain) | [JSON web token (JWT)](https://www.cloudflare.com/learning/access-management/token-based-authentication/) set on the domain protected by Access, used to confirm that the user has been authenticated and is authorized to reach the origin | If [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Admin choice (Default: No) | Admin choice (Default: None) | Yes |
41-
| CF_Binding | Refer to [Binding cookie](/cloudflare-one/identity/authorization-cookie/#binding-cookie) | If [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Yes | None | Optional |
42-
| CF_Session | [CSRF](https://www.cloudflare.com/learning/security/threats/cross-site-request-forgery/) token used on the `cloudflareaccess.com` [team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name) | 4 hours | Yes | None | Required |
43-
| CF_AppSession | [CSRF](https://www.cloudflare.com/learning/security/threats/cross-site-request-forgery/) token used per application domain, scoped to individual applications behind Access | 24 hours | Yes | None | Required |
35+
The following Access cookies are essential to Access functionality. Cookies that are marked as required cannot be opted out of. These cookies are not used for tracking or analytics.
36+
37+
| Cookie | Details | Expiration | HttpOnly | SameSite | Required? |
38+
| ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ---------------------------- | --------- |
39+
| [CF_Authorization](/cloudflare-one/identity/authorization-cookie/#access-jwts) (team domain) | [JSON web token (JWT)](https://www.cloudflare.com/learning/access-management/token-based-authentication/) set on the `cloudflareaccess.com` [team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name) that contains the user's identity ands enables Access to perform single sign-on (SSO) | If [global session duration](/cloudflare-one/identity/users/session-management/#global-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Yes | None | Yes |
40+
| [CF_Authorization](/cloudflare-one/identity/authorization-cookie/#access-jwts) (Access application domain) | [JSON web token (JWT)](https://www.cloudflare.com/learning/access-management/token-based-authentication/) set on the domain protected by Access, used to confirm that the user has been authenticated and is authorized to reach the origin | If [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Admin choice (Default: None) | Admin choice (Default: None) | Yes |
41+
| CF_Binding | Refer to [Binding cookie](/cloudflare-one/identity/authorization-cookie/#binding-cookie) | If [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Yes | None | Optional |
42+
| CF_Session | [CSRF](https://www.cloudflare.com/learning/security/threats/cross-site-request-forgery/) token used on the `cloudflareaccess.com` [team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name) | 4 hours | Yes | None | Required |
43+
| CF_AppSession | [CSRF](https://www.cloudflare.com/learning/security/threats/cross-site-request-forgery/) token used per application domain, scoped to individual applications behind Access | 24 hours | Yes | None | Required |
44+
| CF_Device | Cookie used to help prevent abuse of the [Access OTP flow](https://developers.cloudflare.com/cloudflare-one/identity/one-time-pin/) | 30 days | Yes | Strict | Required |
4445

4546
## Cookie settings
4647

0 commit comments

Comments
 (0)