Cookies

This page describes cookies set by rauth only. Connected applications and identity providers have separate practices.

The __Host-rauth_session cookie carries an opaque session identifier for sign-in and CSRF protection. Path=/; host-only; HttpOnly; SameSite=Lax; Secure=true. Anonymous sessions last 3600 seconds. With “Keep me logged in”, the cookie Max-Age and server session lifetime are 168 hours. Otherwise the browser cookie has no explicit expiry and the server session lasts 2 hours. Browser session restoration may retain session cookies.

The lang cookie remembers your selected language when you use the language switcher. Path=/; host-only; no explicit expiry (browser session); Secure, HttpOnly and SameSite are not explicitly set. Browser defaults apply.

rauth uses these cookies for authentication, security and the language preference you select. It does not set advertising or analytics cookies. The operator must assess applicable cookie rules for the complete deployment.