---
title: DXP cookies
slug: dxp/cms12-docs/dxp-cookies
docTags: 
createdAt: 2026-06-01T17:39:50.094Z
---

A cookie is a small piece of data sent from a website and stored by the web browser on a visitor's computer while browsing a website. The main purpose of a cookie is for websites to remember stateful information or to record a visitor's browsing activity.

Cookies are usually small text files stored locally in the browser directory or program data subfolders. The website stores a corresponding file (with the same ID tag).

Optimizely Digital Experience Platform (DXP) uses the following cookies for various purposes.

- `ARRAffinity` – Required. It routes the request through a web browser to the same machine in the DXC cloud environment. See ARRAffinity - Microsoft Azure. DXP deletes this cookie when you close your browser.
- `ai_session` – Used with Microsoft Application Insights, it collects statistical usage and telemetry information and is a unique anonymous session identifier cookie.
- `ai_user` – Used with Microsoft Application Insights, it collects statistical usage and telemetry information and is a unique user identifier cookie for counting the number of users accessing an application over time.
- `TiPMix` – Used in Azure to pin a user session to a deployment slot during deployments.
- `x-ms-routing-name` – Used in Azure during deployments to route to deployment slots.

For information about other cookies used in the Optimizely platform, see [Optimizely platform cookies](docId\:TEvWgUGynGd4FyVRNQDaT).

## Cookies and Optimizely

Select the following sections to see how users use cookies in parts of the Optimizely platform.

:::Iframe{code="<Anchor title=&#x22;DXP Developer Guide&#x22; href=&#x22;https://docs.developers.optimizely.com/digital-experience-platform/v1.2.0-dxp-cloud-services/docs/cookie-usage&#x22;>"}

:::

DXP cloud services

:::Paragraph{indent="2"}

:::

- [Optimizely Content Management System (CMS)](docId\:TEvWgUGynGd4FyVRNQDaT)
- [A/B testing](docId\:EKO5aFKrSjsNR6Mgr7hQf)
- [Forms](docId\:EKO5aFKrSjsNR6Mgr7hQf)
- [Optimizely Content Recommendations](docId\:zlZB2nLvfYGcbRTeGig4M)
- [Marketing Automation connectors](docId\:EKO5aFKrSjsNR6Mgr7hQf)

## SameSite cookies attributes

With version 80, Google Chrome implemented the changes the IETF has proposed for the `sameSite` cookie attribute. These are:

- The default cookie setting without a `sameSite` attribute changes from `sameSite = None` to  `sameSite = Lax`.
- When using `sameSite = None`, you must also specify **Secure**. Otherwise, the cookie is rejected. **Secure** requires communication over HTTPS.

To comply with these changes, Microsoft ASP.NET emits a `SameSite` cookie header when `HttpCookie.SameSite` value is `None`. `FormsAuth` and `SessionState` cookies are also issued with `SameSite = Lax` instead of the previous default value `None` as part of this change.

See [Work with SameSite cookies in ASP.NET](https://docs.microsoft.com/en-us/aspnet/samesite/system-web-samesite) for documentation on the changes in ASP.NET.

## Known issues - PDF preview for secured PDF

A bug in Chrome affects large PDFs with restricted access when `SameSite = Lax` for forms authentication.

## Troubleshoot cookies

The policy should work for most websites and cookies. Websites that cannot comply with the requirements of `Lax` have to change the default values. An example of a limitation with `Lax` is that you cannot iframe the site under another domain and still use cookie-based features such as authentication and session state.

:::hint{type="info"}
**Note**
Older browsers might not support `sameSite` or implement a different behavior on `sameSite`.
:::

### Configure SameSite for anti-forgery

Configuring the built-in anti-forgery used in Optimizely user interface (requires `EPiServer.CMS.Core` 11.15):

```csharp
context.Services.Configure<AspNetAntiForgeryOptions>(options => {  
  options.CookieSameSiteType = SameSiteType.None;
  options.CookieRequireSSL = true;
});
```

### Configure SameSite for forms authentication

Configuring forms authentication to using `None` and `HTTPS:`

```xml
<authentication>
  <forms cookieSameSite="None" requireSSL="true" />
</authentication>
```

### Configure SameSite for session state

Configuring session state to using `None`:

```xml
<sessionState cookieSameSite="None" cookieless="false" timeout="360">
</sessionState>
```

### Configure SameSite default values for cookies

Configuring the default for cookies that do not explicitly use `sameSite`:

```xml
<httpCookies sameSite="None" requireSSL="true" />
```

### Revert behavior of sending SameSite = None to browsers

Revert to the previous behavior of not sending `sameSite = None` to browsers:

```xml
<appSettings>
  <add key="aspnet:SuppressSameSiteNone" value="true" />
</appSettings>
```

### References

- [SameSite cookies explained](https://web.dev/samesite-cookies-explained/)
- [Azure App Service—SameSite cookie handling and .NET Framework 4.7.2 patch](https://azure.microsoft.com/en-us/updates/app-service-samesite-cookie-update/)
- [Cumulative Update for .NET Framework](https://support.microsoft.com/en-us/help/4533002/kb4533002-cumulative-update-for-net-framework)