Skip to main content
The Auth0 Authentication API uses a set of HTTP cookies to enable single sign-on (SSO), multi-factor authentication (MFA), and attack protection capabilities. The table below shows some of the cookies that the Authentication API relies on and describes their purposes:
Auth0 does not support scenarios in which the noted Authentication cookies are modified in any way, including the addition, modification, or removal of cookie attributes, whether through non-standard browsers, browser add-ons, or HTTP proxies.

​
Cookies and custom domains

If you are using custom domains, cookies from the Authentication API are sent to the custom host name, or CNAME you set up in the . Each cookie’s domain attribute, which specifies the domain for which the cookie is valid, is defined in the cookie request header and domain-matches with the domain attribute. If no domain is specified, the domain attribute defaults to the request-host. If you use IETF’s HTTP State Management Mechanism spec to set cookies on the parent domain, the cookie will be shared with all subdomains of the parent domain. For example, you set your CNAME to login.example_domain.com as a subdomain of example_domain.com. You host other applications under the parent domain, such as app1.example_domain.com and app2.example_domain.com. When users visit login.example_domain.com, cookies from app1.example_domain.com and app2.example_domain.com may be sent along with requests to Auth0’s Authentication API. To safeguard our platform and because these cookies may grow to a considerable size and can be shared with other subdomains, Auth0 may reject requests carrying excessively large (multiple kilobytes) headers. Applications should be designed such that excessively large cookies are not sent to the Auth0 Authentication API. To learn more about cookie behavior with , read Sending Cookies to the Origin Server.

​
Learn more