You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx
+19-5Lines changed: 19 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,11 +16,11 @@ When you protect a site with Cloudflare Access, Cloudflare checks every HTTP req
16
16
17
17
The `CF_Authorization` cookie contains the user's identity in the form of a JSON Web Token (JWT). Cloudflare securely creates these tokens through the OAUTH or SAML integration between Cloudflare Access and the configured identity provider.
18
18
19
-
Two tokens are generated:
19
+
Access generates two separate `CF_Authorization` cookies, each containing its own JWT, depending on the domain:
20
20
21
-
-**Global session token**: a token generated when a user logs in to Access. This token is stored as a cookie at your <GlossaryTooltipterm="team domain">team domain</GlossaryTooltip> (for example, `https://<your-team-name>.cloudflareaccess.com`) and prevents a user from needing to log in to each application.
21
+
-**Global session token**: Generated when a user logs in to Access. This token is stored as a cookie at your <GlossaryTooltipterm="team domain">team domain</GlossaryTooltip> (for example, `https://<your-team-name>.cloudflareaccess.com`) and prevents a user from needing to log in to each application.
22
22
23
-
-[**Application token**](/cloudflare-one/identity/authorization-cookie/application-token/): a token generated for each application that a user reaches. This token is stored as a cookie on the protected domain (for example, `https://jira.site.com`) and may be used to [validate requests](/cloudflare-one/identity/authorization-cookie/validating-json) on your origin.
23
+
-[**Application token**](/cloudflare-one/identity/authorization-cookie/application-token/): Generated for each application that a user reaches. This token is stored as a cookie on the protected domain (for example, `https://jira.site.com`) and may be used to [validate requests](/cloudflare-one/identity/authorization-cookie/validating-json) on your origin.
24
24
25
25
### Multi-domain applications
26
26
@@ -30,6 +30,18 @@ For Access applications with five or less domains, Access will preemptively set
30
30
31
31
If the Access application has more than five domains, Access will not preemptively set any cookies. Cookies are only issued as the user visits each domain. This limitation is to avoid latency issues that could affect the user experience.
32
32
33
+
## Access cookies
34
+
35
+
The following Access cookies are essential to Access functionality. These cookies are not used for tracking or analytics.
|[CF_Authorization](/cloudflare-one/identity/authorization-cookie/#access-jwts) (team domain) |[JSON web token (JWT)](https://www.cloudflare.com/learning/access-management/token-based-authentication/) set on the `cloudflareaccess.com`[team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name) that contains the user's identity ands enables Access to perform single sign-on (SSO) | If [global session duration](/cloudflare-one/identity/users/session-management/#global-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Yes | None | Yes |
40
+
|[CF_Authorization](/cloudflare-one/identity/authorization-cookie/#access-jwts) (Access application domain) |[JSON web token (JWT)](https://www.cloudflare.com/learning/access-management/token-based-authentication/) set on the domain protected by Access, used to confirm that the user has been authenticated and is authorized to reach the origin | If [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Admin choice (Default: No) | Admin choice (Default: None) | Yes |
41
+
| CF_Binding | Refer to [Binding cookie](/cloudflare-one/identity/authorization-cookie/#binding-cookie)| If [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration) is set, adheres to that.<br/><br/> If not, adheres to the [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).<br/><br/> If neither are set, defaults to 24 hours. | Yes | None | Optional |
42
+
| CF_Session |[CSRF](https://www.cloudflare.com/learning/security/threats/cross-site-request-forgery/) token used on the `cloudflareaccess.com`[team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name)| 4 hours | Yes | None | Required |
43
+
| CF_AppSession |[CSRF](https://www.cloudflare.com/learning/security/threats/cross-site-request-forgery/) token used per application domain, scoped to individual applications behind Access | 24 hours | Yes | None | Required |
44
+
33
45
## Cookie settings
34
46
35
47
Cloudflare Access provides optional security settings that can be added to the browser cookies generated by Access for an authenticated user.
@@ -78,9 +90,11 @@ Do not enable HttpOnly if:
78
90
- You are using the Access application for non-browser based tools (such as SSH or RDP).
79
91
- You have software that relies on being able to access a user's cookie generated by Access.
80
92
81
-
### Binding Cookie
93
+
### Binding cookie
94
+
95
+
The binding cookie (`CF_Binding`) is an optional security cookie created when a user successfully authenticates. It binds the browser to the application’s `CF_Authorization` cookie, helping protect against session hijacking-style attacks. The binding cookie is shared with Cloudflare to verify identity, but it is stripped before reaching your origin. Because the origin never sees the binding cookie, this ensures the binding cookie cannot be exposed, logged, or stolen by application-layer vulnerabilities.
82
96
83
-
The Binding Cookie is an additional cookie created when a user successfully authenticates, shared with Cloudflare to verify identity, and then stripped before it reaches the origin server. The Binding Cookie associates the browser with the Access token; the association protects against compromised authorization tokens because the origin webapp would never see this binding cookie. This protects against session hijack style attacks.
97
+
If a request is missing the expected binding cookie, the associated `CF_Authorization`token is rejected, reinforcing session integrity and preventing unauthorized reuse.
0 commit comments