Cookies
Version 2026-09-14. We set only the cookies below. They are strictly necessary to run the service.
| Name | Purpose | Lifetime | Flags |
|---|---|---|---|
wcag_sid | Signed-in session (staff or customer). | 12 hours | HttpOnly; Path=/; SameSite=Lax (or the configured AUTH_COOKIE_SAMESITE); Secure in production |
wcag_csrf | CSRF token read by the browser for API writes. | 12 hours | Path=/; SameSite as the session; Secure in production; not HttpOnly |
wcag_ui | Non-HttpOnly hint so the layout can skip the login overlay (1 staff, c customer). | 12 hours | Path=/; SameSite as the session; Secure in production; not HttpOnly |
wcag_guest | Guest snapshot token so a later signup can attach that scan. | 14 days | Path=/; SameSite=Lax; not HttpOnly |
wcag_freebie | Marks that this browser already used the one free snapshot. | 1 year | Path=/; SameSite=Lax; not HttpOnly |
The signed-in UI also stores sessionStorage.wcagStaff (1 when a staff session is active)
so a tab can keep the staff chrome after a client-side navigation. That value is not a cookie and is cleared when the tab’s session storage is cleared.
Cloudflare Turnstile may set its own cookies on challenges when captcha is enabled. Stripe Checkout and the customer portal set cookies on stripe.com when you pay or manage billing.