How Forms cookies work

## Description of cookies in Forms
Like other web applications, Optimizely Forms uses cookies to implement some business rules and to provide visitors with a better experience. The following cookies are used in Optimizely Forms.
**.EPiForm\_BID** – This cookie is for distinguishing one browser from other browsers that a visitor is using while surfing the internet. If a user visits an Optimizely site for the first time, Optimizely Forms automatically assigns a random GUID to the visitor's browser. The GUID is stored in a cookie and when it has expired, Optimizely Forms creates a new one the next time the user visits the website.
**.EPiForm\_VisitorIdentifier** – This cookie is used to identify who is interacting with the application. It is created by combining the value of .EPiForm\_BID with the current user name in case the user is already logged in. A colon is used as a separator. If the user is not logged in, the value of **.EPiForm\_VisitorIdentifier** is the value of **.EPiForm\_BID** concatenated with a colon. The sample value of this cookie is ‘0f8fad5b-d9cb-469f-a165-70867728950e:admin’.
To keep track of which forms a user is interacting with and if they are either completed or uncompleted, Optimizely Forms uses a cookie name **progressive cookie**. The format of the cookie key is 'EPiForm\_{FormGUID}\_{VisitorIdentifier}'. FormGUID is the primary key of a form instance. Each form instance is given a GUID as unique identifier right after it is created and VisitorIdentifier is the value of the cookie **.EPiForm\_VisitorIdentifier** mentioned above. A sample progressive cookie key is
  **EPiForm\_1g9kfad5z-d9bb-964f-a165-7086772895e\_0f8fad5b-d9cb-469f-a165-70867728950e:admin**
The value of the progressive cookie is a JSON object consisting of following properties:
`FormGUID` – Already mentioned earlier.
`SubmissionID` – The ID of the stored submission data (both finalized and unfinalized) associated with the `FormGUID`.
`IsFinalized` – The status of the form submission. The value is **true** if the user finalizes the form by either clicking the **Finalize Submit** button or finishing all steps of a form instance.  The Submit button form element has a property name **Finalized**. If, for example, a form has three steps and you want to provide users with an opportunity to finish the form at the second step, you can drag a submit button into the form and set the value that property to **true**. Now users can decide to go through all three steps or finish the form at second step.
[block:image]
{
  "images": [
    {
      "image": [  
        "https://files.readme.io/d553307-finalize-property-of-submit-button-2.png",  
        "finalize-property-of-submit-button-2.png",  
        600  
      ],
      "align": "left",
      "border": true
    }
  ]
}
[/block]
## Process for handling cookies
After submitting a form or navigating to another form step, Optimizely Forms checks if the progressive cookie related to the form instance (and current VisitorIdentifier) exists or not:
**Progressive cookie exists**
If the cookie does exist, the server retrieves the `IsFinalized` value from that cookie. If the value is **true**, Optimizely Forms gets the Form `SubmissionID` from the submitted data (via a hidden field); otherwise, the  `SubmissionID` is obtained from the progressive cookie. If the value of `IsFinalized` is true, it means that the form allows multiple submissions from the same IP address/cookie and that the user has completed submitting data at least once plus this time of submitting.
**Progressive cookie does not exist**
If the progressive cookie does not exist, Optimizely Forms gets the `SubmissionID` from the submitted data. Next, Optimizely Forms checks if the `SubmissionID` is null. If it is null, the submission data is saved to the storage as a new record. If it is not null, it means that the form instance has multi-steps and the user has already interacted with that form but not completed whole steps. The submitted data is updated to an existing record by the `SubmissionID`.
After saving or updating submission data, the output of the process is `SubmissionID` and progressive cookie is set (creating a new one if no one exists or updating existing cookie). The last process is to load the form elements of the next step along with the `SubmissionID` and display on the page. The `SubmissionID`is used in a hidden field for the next navigation or submission.
Because an Optimizely Forms application may have multiple instances of a form (for example, Form\_1 and Form\_2), there may be many progressive cookies. For example, if a user visits an Optimizely site and just finishes step 1 out of three steps on Form\_1, and then directly jumps to Form\_2 and starts entering information, then two progressive cookies are created. Those cookies tell the server that the user interacted with two different form instances, no matter if they were completed or not.
﻿
### JavaScript enabled
If Javascript is enabled, navigating between steps (both previous step and next step) are performed via an AJAX request and the client uses the session storage to temporarily store submission data. Thus, if the form has multiple steps and a user fills in form data in the last step but wants to go back to the previous step, the entered data is still being retained. The user does not have to re-insert data and the server does not need to hit the database to fetch data.
### JavaScript disabled
If Javascript is disabled, navigating between steps causes the browser to get redirected to a certain page to display form steps and Optimizely has to hit the database to retrieve already entered data, and fill in form elements.
## Manage cookie expiration time
For consistency, all cookies mentioned above are set to the same expiration time.
The `IVisitorIdentifyProvider` interface is responsible for handling form cookie expiration time of visitors. `DefaultVisitorIdentifyProvider` is the default implementation. There are few points to note:
The function `SetVisitorIdentifier` is used to set the **.EPiForm\_VisitorIdentifier** cookie for identifying visitors.
Currently, the expiration time unit is based on day and the default expiration time is 90 days. You can modify this setting in the _Forms.config_ file with the key `visitorSubmitTimeout`.
[block:image]
{
  "images": [
    {
      "image": [  
        "https://files.readme.io/db8c7fe-episerver-forms-visitor-timeout.png",  
        "episerver-forms-visitor-timeout.png",  
        861  
      ],
      "align": "center",
      "border": true
    }
  ]
}
[/block]
The property `Order`: Optimizely Forms scans all assemblies to find out which implementation of `IVisitorIdentifyProvider` interface will be executed based on Ascending Order. If there are multiple implementations, the implementation with the lowest order is executed. The default order is 1000 in the `DefaultVisitorIdentifyProvider` class.
If you want to customize the expiration time of Optimizely Forms, you need to implement the `IVisitorIdentifyProvider` interface either by inheriting the `DefaultVisitorIdentifyProvider` class and overriding desired functions or creating a new class and implementing all functions in `IVisitorIdentifyProvider` from scratch. The recommendation is to inherit the `DefaultVisitorIdentifyProvider` class for simplicity. Example code:
﻿