Frequently asked questions

Together they are how the app knows you are signed in. The access cookie is a short-lived pass (about 15 minutes) that the browser sends with every request. The refresh cookie is a longer-lived pass that is only sent to the sign-in routes, where it is exchanged for a new access cookie when the old one expires, so you are not asked to sign in every 15 minutes.

The CSRF cookie is a safety check. It protects you from other websites that try to make your browser send requests to this app on your behalf.

Not the access and refresh cookies. They are marked HTTP-only, so page scripts cannot read them, even if a bug let someone run a script on the page. Only the browser itself attaches them to requests. Your developer tools can show them because that is your own browser.

Both are also marked Secure (sent over HTTPS only) and SameSite, so they are not sent along with requests started from other sites.

It is meant to be readable. The app copies its value into a request header, and the server only accepts a request when the header and the cookie match. Another website cannot read the cookie, so it cannot build that header.

It is not a sign-in credential and does not identify you, so having it readable does not put your account at risk.

Without the access cookie the server cannot tell who you are, and without the refresh cookie the app cannot quietly get a new one. So it treats you as signed out and sends you to the sign-in page. This is expected, and the same thing happens when you sign out or your session ends.

HTTP-only cookies make it much harder to steal a session from the page, but nothing can protect a computer that is already compromised, or one that someone else can use while you are signed in. Sign out on shared computers, keep your browser up to date, and change your password if you think someone has access.