Technical Tip: Enable session-based cookie for cookiesession1

[shafiq23]

Description	This article describes how to change cookiesession1 inserted by FortiWeb in the client’s browser to a session-based cookie.
Scope	FortiWeb v7.0.2 and later.
Solution	By default, with ‘Client Management’ enabled in the Web Protection Profile, FortiWeb inserts a persistent cookie (365 days validity) into the client’s browser for client tracking. If such a persistent cookie is not preferred, change cookiesession1 to a session-based cookie with the commands below. config waf web-protection-profile inline-protection     edit <web-protection-profile name>         set http-session-cookie enable     next end Note: The session-based cookie only lasts if the browser is open and is automatically deleted when a user closes the browser or exits the app. Steps to verify. From the client’s browser: Browse the website protected by FortiWeb. Open the browser developer tool. Verify cookiesession1 expiration or session flag. Related articles about cookiesession1: Technical Tip: How to enable cookiesession1 with secure flag  Technical Tip: cookiesession1 secure flag requirement