Cookie usage

Cookies are small text files that a browser stores to maintain session state, support security mechanisms, and enable platform functionality. In Content Management System (CMS) (SaaS), these cookies support authentication, security, analytics, and platform operations for administrators and editors who access the CMS UI.

The cookies described in this article

Apply primarily to administrators and editors.
Are managed by Optimizely as part of the SaaS platform.
Are not used to track public website visitors unless explicitly stated.

Cookie scope and responsibility

Optimizely manages cookies required for CMS (SaaS) functionality, security, analytics, and infrastructure.
Customers cannot modify or override CMS (SaaS) authentication, security, or infrastructure cookies.
Customers are responsible for documenting CMS (SaaS) cookies in internal privacy notices provided to administrators and editors.
Optimizely manages visitor-facing website cookies separately, and their management depends on customer implementation.

Customer configuration capabilities

In Optimizely CMS (SaaS)

Customers can do the following:

Review and document CMS (SaaS) cookies in internal privacy notices.
Disable optional analytics features where supported.

Customers cannot do the following:

Modify authentication, essential, or infrastructure cookies.
Remove required CMS (SaaS) cookies.
Change cookie security attributes.

Cookie categories

Optimizely CMS (SaaS) uses cookies in the following categories:

Essential – Required for authentication, security, and core CMS (SaaS) functionality.
Functional – Support CMS (SaaS) UI features and workflows.
Analytics – Collect aggregated usage data to improve product reliability and usability.
Infrastructure – Support cloud hosting and platform operations.

CMS (SaaS) cookie inventory

The following table lists cookies used by Optimizely CMS (SaaS):

Cookie name	Category	Purpose	Required	Storage duration	HttpOnly	Applies to
`epihash`	Functional	Preserves URL hash during login redirect to maintain navigation context.	Yes	5 minutes	No	Administrators
`.ImageEditorFileSize.`	Functional	Stores image file size for the CMS (SaaS) Image Editor UI.	Yes	Session	No	Administrators
`.AspNetCore.Antiforgery.*`	Essential	Protects the CMS (SaaS) UI against cross-site request forgery (CSRF).	Yes	Session	Yes	Administrators
`oid-login*`	Essential	Maintains authentication session for Optimizely Identity.	Yes	Configurable (default: session)	Yes	Administrators
`ajs_user_id`	Analytics	Segments user identifier for CMS (SaaS) usage analytics (third party).	No	1 year	No	Administrators
`ajs_group_id`	Analytics	Segments organization identifier for CMS (SaaS) usage analytics (third party).	No	1 year	No	Administrators
`ajs_anonymous_id`	Analytics	Segments anonymous session identifier for CMS (SaaS) usage analytics.	No	1 year	No	Administrators
`ai_session`	Analytics	Routes requests within the Azure cloud environment.	Yes	Session	Yes	All users
`ARRAffinity`	Infrastructure	Handles Azure routing cookie with `SameSite` support.	Yes	Session	Yes	All users
`ARRAffinitySameSite`	Infrastructure	Tracks Microsoft Application Insights sessions.	No	30 minutes	No	All users

Third-party services CMS (SaaS) uses

Optimizely CMS (SaaS) uses the following third-party services that set cookies:

Microsoft Azure

Provides cloud hosting, routing, and deployment infrastructure. Uses infrastructure cookies such as ARRAffinity.

Microsoft Application Insights

Collects aggregated telemetry and performance data to monitor service health. Uses analytics cookies such as ai_session.

Segment

Collects CMS (SaaS) usage analytics to improve product usability and reliability. Uses analytics cookies such as ajs_*.

Optimizely Identity

Provides authentication and authorization using OpenID Connect (OIDC). Uses authentication cookies such as oid-login*.

SameSite cookie behavior

The SameSite attribute controls when browsers send cookies with cross-site requests. Optimizely CMS (SaaS) applies SameSite and Secure attributes according to current browser requirements.

Supported values include the following:

SameSite=Lax
SameSite=Strict
SameSite=None (requires HTTPS)

Optimizely manages these attributes at the platform level. Customers cannot configure SameSite behavior for CMS (SaaS) cookies.

Modern browsers enforce stricter cookie handling rules.

Browsers default to SameSite=Lax when no value is specified.
Cookies that use SameSite=None must also use the Secure attribute.
Older browsers may not fully support SameSite.

The Optimizely CMS (SaaS) platform handles these behaviors.

Known limitations

Browser restrictions may affect cross-domain scenarios that rely on cookies, including embedded iframes.
Browser-specific limitations may impact certain secured downloads in rare scenarios.