Hi, I'm facing the problem that our users are being logged out silently after one or two weeks. I checked the ory console and the sessions are still valid. It appears that the session cookies are missing all of a sudden. I understand that this issue can be on our side or on the ory side but I'm struggling to find the reason for these logouts. Do you have any ideas where I should look in order to make sure that the problem isn't caused by ory itself? Does ory clear cookies when a certain error occurs?

Hey @stocky-oil-75309 Normally, session cookies are only removed by the browser when: • The cookie expires (based on its

max-age

or

expires

attribute). • The user logs out, and Ory instructs the browser to delete the cookie. • The browser is closed (if the cookie is not persistent). • The user or browser extensions clear cookies manually. some tips to debug: • Check the cookie settings in Console or your config, should look like this:

session:
  cookie:
    persistent: true

• Some browsers, like Safari, limit cookie lifespans (e.g., to 7 days) due to privacy features like Intelligent Tracking Prevention (ITP). This can cause cookies to disappear even if the session is still valid on the server. • Misconfigured cookie domain or SameSite attributes can prevent cookies from being sent or cause them to be dropped. Ensure your cookie domain is set to the root domain if you want it shared across subdomains. see docs • Users clearing cookies, browser extensions, privacy settings, or anti-virus software can also remove cookies unexpectedly. Ideally you can reproduce this on your side, so you can check what is going on with browser dev tools.

Hello, thank you for answering. I am still working on this problem. The debugging cycle was about a week that's why it's taking so long. I am again debugging it and I see that the Ory session expires in 10 years in the ory console. But when looking at the properties of the cookie, it says it will expire in one week. Any ideas how this can be?

Hey @stocky-oil-75309 Hm that is strange, might be an error on the frontend. If possible at all would you be able to share steps how I can reproduce this on a fresh project? That would help us a lot to get to the bottom of it.

I don't think I can setup a whole new proof-of-work env for this problem. But I now see that this problem is definitely caused by Safaris ITP (intelligent tracking prevention). When logging in https://maps.future.coop/de/login on Chrome I see that the header of the login response (from ory) correctly tells the browser that this cookie should be valid for 10 years. However when checking the cookie storage it's only valid for 400 days. In Safari this is even more extreme, where it is only 7 days. Now I need to figure out why these systems falsely detect these cookies as suspicious and think they are tracking cookies. You don't have documentation on this, how to prevent these false negatives regarding ITP? The cookie is returned from auth.future.coop and the domain is the common .future.coop, so this is correctly configured I think.

I think it's referring to using Cloudflare as proxy/DNS, not registrar.

I have now proxied pretty much everything via cloudflare. maps.future.coop, auth.future.coop (ory backend) etc. and the expiration time is now 400 days on Safari, so I guess that's the best that can be done..