I have a site. My site does not have any cookies. It is developed with Drupal 8(CMS) and have few articles. Just for a curiosity I did check whether my website uses cookies or not. I did use Firefox to check.

The Firefox message box showed that, your site is using cookies as shown below. What this cookies is for? Do I have to add information about this cookie in my privacy policy.


  • 1
    Could you post the name of the cookie? The name alone should not be sensitive information. – Anders Feb 4 '17 at 6:50
  • @Anders Hi, It does not have any logical name, it is a long combination of alpha-numericals. Even content is also alpha-numbericals in above image. Hence I did hide that. Do you want me to post that one? – codenext Feb 4 '17 at 6:53
  • 2
    I have a website that does not have cookies. Here's a cookie from that website. No, you can't see it. Tell me what it's for. :-) You have to admit this is hard to answer. – Jedi Feb 4 '17 at 7:08
  • Do you use any in-built Drupal functionality for logins? Any analytics scripts GA/Piwik? We probably will need to see at least the name to give a useful answer... and probably not even then... Is it alphanumeric or Base64 or alphanumeric-hex (only 0-9a-f)? – Jedi Feb 4 '17 at 7:10
  • @Jedi That is my question...:) I did not set anything by myself, So why it is showing and surprisingly Chrome is not showing this cookie. – codenext Feb 4 '17 at 7:10

The cookie may be a Drupal or PHP session cookie. Drupal is as PHP application. PHPSESSID is the default PHP session cookie name. Drupal overrides this default with a name starting with SESS, followed by a hash. The hash is a hexadecimal representation of an MD5 hash of the session name or the value of the cookie_domain setting in the settings.php file. Since you blocked the name, I can't tell for sure whether taht is what you are seeing. This may help.

| improve this answer | |
  • Yes, you are right, it is a SESS, and I later found that, that cookie is only appearing when I am logged in as a administrator. – codenext Feb 4 '17 at 9:21
  • 1
    The set cookie header should return from the HTTP PUT that authenticates, regardless of the account name. – FauChristian Feb 4 '17 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.