Technical session cookie
When you log in using a temporary code, the portal uses the technical cookie of the PHP session to recognize the browser during authenticated browsing. Only a random session identifier is stored in the cookie: the OTP code, personal data and application documents are not written in the cookie.
Purpose
The session is used to maintain access to the reserved area, protect user operations, resume the first step still to be completed and prevent applications or payments from being associated with the wrong person.
Duration
The configured maximum duration is currently 8 hours of inactivity. During valid use, the expiry date is renewed. Once the period of inactivity has elapsed, you must log in again via OTP.
Applied measures
- HttpOnly: the cookie is not readable by the scripts on the page;
- Secure: in production is transmitted via HTTPS connection;
- samesite=LAX: limits the sending of the cookie when browsing from other sites;
- regeneration of the identifier: after authentication, a new session identifier is generated;
- explicit logout: leaving the personal area invalidates the session and its cookie.
No advertising purpose
The authenticated session cookie is not used for commercial profiling or advertising. Any external services activated by the user, such as online payment or anti-abuse checks, operate according to their respective policies.
Browser management
The browser allows you to delete cookies at any time. The removal of the session cookie causes the exit from the personal area and requires a new login.
For the overall picture of the treatments, consult thecurrent Privacy Policy.