Issue
- Is Liferay creating a cookies site base? If so, where exactly on the Liferay server would all the cookies be physically kept?
Environment
- Liferay DXP 7.1
- Liferay DXP 7.2
- Liferay DXP 7.3
- Liferay DXP 7.4
Resolution
-
The majority of Liferay's cookies are of the "Persistent" type. As an illustration, if user choose to be identifiable by clicking the "Remember me" button when login, Liferay maintains a long-lasting encrypted cookie so that when user return, the information, such as username, is already stored.
- This category encompasses all cookies that remain on the hard drive until user erase them or or their browser does, depending on the cookie’s expiration date. The length of persistent cookies can vary, but they all have an expiration date embedded into their coding. The ePrivacy Directive states that they should expire after 12 months, but in practice, if you do nothing, they might stay on device for much longer.
- This category encompasses all cookies that remain on the hard drive until user erase them or or their browser does, depending on the cookie’s expiration date. The length of persistent cookies can vary, but they all have an expiration date embedded into their coding. The ePrivacy Directive states that they should expire after 12 months, but in practice, if you do nothing, they might stay on device for much longer.
- Cookies are only generated at the browser level and get destroyed once the session is closed/expired. There is no physical copy stored on the Liferay server related to cookies.
Additional Information
-
However, the properties listed below allow user to enable or disable cookies.
# Set this to the maximum age (in number of seconds) of the browser cookie that enables the "remember me" feature. A value of 31536000 signifies lifespan of one year. A value of -1 signifies a lifespan of a browser session. company.security.auto.login.max.age=31536000 # Set this to false to disable all persistent cookies. Features like automatically logging in will not work. session.enable.persistent.cookies=true # Set this to true to use the full hostname for cookie domain values. By default the domain is trimmed to use only the root domain to allow cross domain logins. session.cookie.use.full.hostname=false session.cookie.use.full.hostname[tomcat]=true # Set this to true to test whether users have cookie support before allowing them to sign in. session.test.cookie.support=true