# \#cookie **URL:** https://community.auth0.com/tag/cookie/638.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Cookies vs. Access Tokens: Securing the Authorization Code Flow in Browser-Based Apps](https://community.auth0.com/t/cookies-vs-access-tokens-securing-the-authorization-code-flow-in-browser-based-apps/204001)
**Author:** [@christina.johnson](https://community.auth0.com/u/christina.johnson)\ **Replies:** 2\ **Last updated:** [October 7, 2026, 10:39pm UTC](https://community.auth0.com/t/cookies-vs-access-tokens-securing-the-authorization-code-flow-in-browser-based-apps/204001 "2026-10-07T22:39:58Z")
When architecting a Single Page Application (SPA) in frameworks like React, Angular, or Vue, developers inevitably reach a crossroads: Where should I store my access tokens once they are returned to the browser? This arc… --- ## [Feature Request: Ability to Invalidate Auth0 Session Cookies During Signup / Aborted Authentication Flows](https://community.auth0.com/t/feature-request-ability-to-invalidate-auth0-session-cookies-during-signup-aborted-authentication-flows/196373)
**Author:** [@lee.baron](https://community.auth0.com/u/lee.baron)\ **Replies:** 2\ **Last updated:** [March 4, 2026, 4:22pm UTC](https://community.auth0.com/t/feature-request-ability-to-invalidate-auth0-session-cookies-during-signup-aborted-authentication-flows/196373 "2026-03-04T16:22:49Z")
Feature: Ability to Invalidate Auth0 Session Cookies During Signup / Aborted Authentication Flows Description: During Universal Login flows, an Auth0 session cookie (auth0=...) may exist before user creation or before a… --- ## [V2/logout not clearing auth0 session cookies](https://community.auth0.com/t/v2-logout-not-clearing-auth0-session-cookies/69327)
**Author:** [@Alex0](https://community.auth0.com/u/Alex0)\ **Replies:** 7\ **Last updated:** [April 1, 2025, 8:21pm UTC](https://community.auth0.com/t/v2-logout-not-clearing-auth0-session-cookies/69327 "2025-04-01T20:21:49Z")
Hi there, I have a react SPA using auth0 SP with a SAML auth0 Idp for authentication. The login authentication is working great. the problem is the logout, when users click on a logout button, it triggers the logout aut… --- ## [Setting up a SPA + API combo with React and .NET Core](https://community.auth0.com/t/setting-up-a-spa-api-combo-with-react-and-net-core/53098)
**Author:** [@pdevito3](https://community.auth0.com/u/pdevito3)\ **Replies:** 2\ **Last updated:** [March 5, 2024, 6:17pm UTC](https://community.auth0.com/t/setting-up-a-spa-api-combo-with-react-and-net-core/53098 "2024-03-05T18:17:19Z")
So I’m looking into Auth0 as the foundation for a few of my projects and I’m pretty sure I know how I want to set it up, but I’m having trouble finding resources on what to do for Auth0. For context, I have a react app … --- ## [NextJs Cookie lifetime - Security concerns?](https://community.auth0.com/t/nextjs-cookie-lifetime-security-concerns/86749)
**Author:** [@theo.camboulive](https://community.auth0.com/u/theo.camboulive)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 10:56am UTC](https://community.auth0.com/t/nextjs-cookie-lifetime-security-concerns/86749 "2022-07-12T10:56:36Z")
Quick question: We are thinking to increase the Auth Cookie lifetime to 14 days instead of 1 as default. Is that something you would advise against security wise? Why do we need to do this? When a user comes back to our… --- ## [React-Native-iOS App rejected because of App tracking transparency](https://community.auth0.com/t/react-native-ios-app-rejected-because-of-app-tracking-transparency/75105)
**Author:** [@harshal.morey](https://community.auth0.com/u/harshal.morey)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 6:05pm UTC](https://community.auth0.com/t/react-native-ios-app-rejected-because-of-app-tracking-transparency/75105 "2022-03-14T18:05:23Z")
Apple rejected my app saying "We noticed your app accesses web content you own where you collect cookies. Cookies may be used to track users, but you do not use App Tracking Transparency to request the user’s permission… --- ## [Can't use getAccessTokenSilently after enabling rotating refresh token when 3rd party cookies are blocked](https://community.auth0.com/t/cant-use-getaccesstokensilently-after-enabling-rotating-refresh-token-when-3rd-party-cookies-are-blocked/64241)
**Author:** [@lchen](https://community.auth0.com/u/lchen)\ **Replies:** 2\ **Last updated:** [June 10, 2021, 6:12pm UTC](https://community.auth0.com/t/cant-use-getaccesstokensilently-after-enabling-rotating-refresh-token-when-3rd-party-cookies-are-blocked/64241 "2021-06-10T18:12:14Z")
Spend the whole night and have 50+ tabs opened but still can’t find why it’s not working. The issue here is exactly like https://community.auth0.com/t/is-it-currently-impossible-without-custom-domains-to-get-a-token-wit… --- ## [Reading Auth0 Session Cookie in Express](https://community.auth0.com/t/reading-auth0-session-cookie-in-express/61782)
**Author:** [@wkersting](https://community.auth0.com/u/wkersting)\ **Replies:** 2\ **Last updated:** [April 27, 2021, 3:18pm UTC](https://community.auth0.com/t/reading-auth0-session-cookie-in-express/61782 "2021-04-27T15:18:12Z")
Hello, Auth0 forums - I’m wondering if it is possible to read / unsign an Auth0 session cookie in an Node / Express application. I am generating this cookie via a Next.js application using the nextjs-auth0 module and a… --- ## [Token in appSession cookie cannot be decoded](https://community.auth0.com/t/token-in-appsession-cookie-cannot-be-decoded/60591)
**Author:** [@williamwjs](https://community.auth0.com/u/williamwjs)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 8:11pm UTC](https://community.auth0.com/t/token-in-appsession-cookie-cannot-be-decoded/60591 "2021-04-08T20:11:44Z")
We are using nextjs auth0 SDK to integrate: GitHub - auth0/nextjs-auth0: Next.js SDK for signing in with Auth0 However, the appSession cookie (with value eyJhbGciOiJka…) generated from it does seem to be in JWT format, … --- ## [Programmatically closing SSO session](https://community.auth0.com/t/programmatically-closing-sso-session/38584)
**Author:** [@drose](https://community.auth0.com/u/drose)\ **Replies:** 2\ **Last updated:** [January 31, 2025, 5:58pm UTC](https://community.auth0.com/t/programmatically-closing-sso-session/38584 "2025-01-31T17:58:10Z")
Currently we have situations where invalidating the existing SSO session(s) for a user could increase security: These include: When the user changes their email address When a user adds MFA When a user changes their p… --- ## [Callback UnauthorizedError not deleting auth0 cookie for a domain](https://community.auth0.com/t/callback-unauthorizederror-not-deleting-auth0-cookie-for-a-domain/10806)
**Author:** [@yshridhare](https://community.auth0.com/u/yshridhare)\ **Replies:** 1\ **Last updated:** [December 18, 2018, 5:02pm UTC](https://community.auth0.com/t/callback-unauthorizederror-not-deleting-auth0-cookie-for-a-domain/10806 "2018-12-18T17:02:39Z")
We have this snippet of code in an Auth0 rule to check if the given user is inactive. This functionality is part of our application where user access is disabled for a specific resource. When an inactive user tries to l… --- ## [Delete Auth0 cookie on signout](https://community.auth0.com/t/delete-auth0-cookie-on-signout/9291)
**Author:** [@abdul.atta](https://community.auth0.com/u/abdul.atta)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 6:07pm UTC](https://community.auth0.com/t/delete-auth0-cookie-on-signout/9291 "2018-12-14T18:07:38Z")
Just upgraded our Applications to use Auth 9 and Lock 11. We were having some browser issues with third party cookies so we also added a fallback page as needed. On the Safari browser, when I log in, log out and then tr… --- ## [Clear the SSO cookie in Auth0 when .NET Cookie Expires](https://community.auth0.com/t/clear-the-sso-cookie-in-auth0-when-net-cookie-expires/8642)
**Author:** [@floyd](https://community.auth0.com/u/floyd)\ **Replies:** 1\ **Last updated:** [November 2, 2017, 8:59pm UTC](https://community.auth0.com/t/clear-the-sso-cookie-in-auth0-when-net-cookie-expires/8642 "2017-11-02T20:59:04Z")
We are using ASP.NET (OWIN) integration in our MVC application. When our Asp.net cookie expires, we are correctly redirected to the login which provides the Auth0 login, however because the Auth0 SSO cookie is still val… --- ## [Is it possible to set a cookie in a rule?](https://community.auth0.com/t/is-it-possible-to-set-a-cookie-in-a-rule/8179)
**Author:** [@brad2](https://community.auth0.com/u/brad2)\ **Replies:** 0\ **Last updated:** [September 14, 2017, 11:24am UTC](https://community.auth0.com/t/is-it-possible-to-set-a-cookie-in-a-rule/8179 "2017-09-14T11:24:02Z")
Is it possible to set a cookie specific to yourtenant.auth0.com in a rule? I didn’t see if exposed anywhere but wanted to check.