> This page is for Applications Protection. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.humansecurity.com/llms.txt. # Use of cookies & web storage HUMAN products use a combination of cookies, local storage, and session storage. For best system operation, we recommend you unblock all HUMAN cookies and local and session storage keys listed below. ## Browser cookies > **Tip** > > Scroll horizontally or expand to see full table data. | Cookie name | Product usage | Description | Type | Expiration | 1st or 3rd Party | Category | Size | Notes | | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ------------------------- | ---------------- | ------------------ | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | `_px*` (e.g `_px`, `_px2`, `_px3`) | Sightline Cyberfraud Defense, Bot Defender | Used to maintain a session with HUMAN. It does not correspond to any user ID in the web application and does not store any personally identifiable information. | JS | 5.5 minutes | 1st Party | Strictly Necessary | up to 500B | Visitor ID (randomly generated ID) Session ID (uuid) Time expiration | | | `_pxac` | Sightline Cyberfraud Defense, Bot Defender | Allows passing an access token that the Enforcer extracts. If the value matches the Console token, the request is whitelisted. | N/A | N/A | N/A | N/A | Access token (Free pass) | N/A | You must add the cookie to the request by creating an endpoint that sets the cookie. | | `_pxde` | Sightline Cyberfraud Defense, Bot Defender | Data enrichment feature (e.g., is the user in access control) | JS | 5 days | 1st Party | Analytics | 100B-200B | Hashed incident type Hashed access control identification | | | `_pxff_*` (e.g `_pxff_af_c`, `_pxff_af_rf`, `_pxff_af_se`, `_pxff_af_sp`, `_pxff_af_wp`, `_pxff_bdd`, `_pxff_idp_c`, `_pxff_idp_p`, `_pxff_wa`, `_pxff_wow`, `_pxff_ww`, `_pxff_tm`) | Sightline Cyberfraud Defense, Bot Defender | Used to flag features for browser detection and distinguishing whether it is a real user or malicious bot. | JS | 1 day | 1st Party | Strictly Necessary | 9B-20B | All `pxff` cookies are feature flags for HUMAN code, including no visitor-specific data, but instead instructions for HUMAN client-side code. | | | `_pxhd` | Sightline Cyberfraud Defense, Bot Defender | Used for server-side detection and distinguishing whether it is a real user or malicious bot. | HTTP | 1 year | 1st Party | Strictly Necessary | 106B | Visitor ID (randomly generated ID) | | | `_pxmvid` | Sightline Cyberfraud Defense, Bot Defender | User Token (from WebView via mobile SDK integration) | JS | 1 hour | 1st Party | Strictly Necessary | 43B | Visitor ID (randomly generated ID) | | | `_pxttld` | Sightline Cyberfraud Defense, Bot Defender | Determines the appropriate domain settings for cookies to enable site-wide detection functionality | JS | 1 millisecond | 1st Party | Strictly Necessary | 8B | | | | `_pxvid` | Sightline Cyberfraud Defense, Bot Defender, Code Defender | Used for browser detection and distinguishing whether it is a real user or malicious bot. | JS | 1 year | 1st Party | Strictly Necessary | 42B | Visitor ID (randomly generated ID) | | | `pxcts` | Sightline Cyberfraud Defense, Bot Defender, Code Defender | Used to maintain a cross-tab session | JS | session | 1st Party | Strictly Necessary | 43B | Cross-tab session (randomly generated ID). Falls back to [local storage](#local-pxcts) if first-party cookies are blocked. | | | `__pxvid` | Code Defender | Used to differentiate users for cost purposes as well as counters, such as how many users were exposed to a certain behavior caused by a script. HUMAN can add a secure flag to this cookie upon request. | JS | 1 year | 1st Party | Strictly Necessary | 43B | Visitor ID (randomly generated ID) | | | `_pxwvm` | Bot Defender, Account Defender | Configured by the Mobile SDK to indicate to the Sensor that it’s operating within a web view context inside a mobile app. | JS | session / 1 year | 1st Party | Strictly Necessary | N/A | | | | `_pxmd` | Bot Defender, Account Defender | Contains data from the Mobile SDK related to the current session. | JS | Session / Session storage | 1st Party | Strictly Necessary | N/A | | | | `_pxda` | Bot Defender, Account Defender | Indicates that the Doctor App feature is enabled in the Mobile SDK. | JS | Session | 1st Party | N/A | N/A | | | | `_px_mobile_data` | Bot Defender, Account Defender | Contains data from the Mobile SDK related to the current session. | JS | Session / Session storage | 1st Party | Strictly Necessary | N/A | | | ## Local storage keys | Key name | Product usage | Function | Description | | -------------------- | --------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------- | | `_advanced_features` | Sightline Cyberfraud Defense, Bot Defender | Execution control | Ensures a specific activity runs only once. | | `fsch` | Sightline Cyberfraud Defense, Bot Defender | Window events detection | Keeps track of identified events to prevent adding more after identification. | | `pxcts` | Sightline Cyberfraud Defense, Bot Defender, Code Defender | Session data | Stores session data if the browser blocks first-party cookies. Fallback for the browser cookie [`pxcts`](#browser-pxcts). | | `px-ff` | Sightline Cyberfraud Defense, Bot Defender | Feature flags | Holds feature flags to be kept for next sessions. | | `px_hvd` | Sightline Cyberfraud Defense, Bot Defender | Visitor identification | The hashed visitor identifier (VID). | | `px_22j9f8hlau2f5` | Code Defender | Dynamic mitigation | Relevant if you have blocking rules. Updates every time block rules update. | | `px_33df3rmnerrf5` | Code Defender | Feature flags | Updates on every session (every website load). | ## Session storage keys | Key name | Product usage | Function | Description | | ------------- | ------------------------------------------ | ---------------------- | -------------------------------------------------------------------------------------------------------------------- | | `_pr_c` | Sightline Cyberfraud Defense, Bot Defender | Cross-session mapping | Contains the client's UUID from the previous session. | | `px_c_p_` | Sightline Cyberfraud Defense, Bot Defender | Routing configuration | Indicates the last selected path for communicating with collectors. | | `px_fp` | Sightline Cyberfraud Defense, Bot Defender | Device fingerprinting | Stores fingerprint data (used as a fallback if local storage isn't available). | | `px_nfsp` | Sightline Cyberfraud Defense, Bot Defender | Session entry tracking | An indicator that this is the first page viewed in the session. | | `pxsid` | Sightline Cyberfraud Defense, Bot Defender | Session management | Session identifier. | | `pxtiming` | Sightline Cyberfraud Defense, Bot Defender | Performance metrics | KPIs for communication with the backend. | | `px_11a381f6` | Code Defender | Session ID | Set for every new user (every browser entering the website for the first time). Persists indefinitely for that user. | ## HttpOnly and Secure Flags By default, HUMAN cookies are not set with the HttpOnly and Secure flags, for the following reasons: The **HttpOnly** flag prevents client-side scripts from accessing cookies. However, Bot Defender uses a Java Script snippet called Sensor, which is embedded in all protected pages. To operate, Sensor needs to access HUMAN cookies. The **Secure** flag ensures that cookies are sent over the HTTPS protocol only. However, Bot Defender protects against malicious bots over both HTTPS and HTTP protocols. It also requires cookies to be sent to the server side. Where only HTTPS is used for all the traffic, including APIs, the Secure flag can be set. It is important to note that HUMAN secures information carried by cookies using all necessary means of protection, including encryption, hash functions, and signatures.