Cookies

Configure cookie preferences.

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 60	Available since 60	Available since 149

RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4, reject-tracker-and-partition-foreign renamed to partition-foreign in Firefox 153.

CCK2 Equivalent: N/A
OMA-URI: Cookies
Preferences Affected: network.cookie.cookieBehavior, network.cookie.cookieBehavior.pbmode, network.cookie.lifetimePolicy

Examples

policies.json

{
  "policies": {
    "Cookies": {
      "Allow": [
        "http://example.org/"
      ],
      "AllowSession": [
        "http://example.edu/"
      ],
      "Block": [
        "http://example.com/"
      ],
      "Locked": true,
      "Behavior": "accept",
      "BehaviorPrivateBrowsing": "accept"
    }
  }
}

JSON schema

Cookies JSON schema

{
  "type": "object",
  "properties": {
    "Allow": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uri",
        "pattern": "^([Ff][Ii][Ll][Ee]://.*|[Hh][Tt][Tt][Pp][Ss]?://[^/]+/?)$"
      }
    },
    "AllowSession": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uri",
        "pattern": "^([Ff][Ii][Ll][Ee]://.*|[Hh][Tt][Tt][Pp][Ss]?://[^/]+/?)$"
      }
    },
    "Block": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uri",
        "pattern": "^([Ff][Ii][Ll][Ee]://.*|[Hh][Tt][Tt][Pp][Ss]?://[^/]+/?)$"
      }
    },
    "Default": {
      "type": "boolean"
    },
    "AcceptThirdParty": {
      "type": "string",
      "enum": [
        "always",
        "never",
        "from-visited"
      ]
    },
    "RejectTracker": {
      "type": "boolean"
    },
    "ExpireAtSessionEnd": {
      "type": "boolean"
    },
    "Locked": {
      "type": "boolean"
    },
    "Behavior": {
      "type": "string",
      "enum": [
        "accept",
        "reject-foreign",
        "reject",
        "limit-foreign",
        "reject-tracker",
        "reject-tracker-and-partition-foreign",
        "partition-foreign"
      ]
    },
    "BehaviorPrivateBrowsing": {
      "type": "string",
      "enum": [
        "accept",
        "reject-foreign",
        "reject",
        "limit-foreign",
        "reject-tracker",
        "reject-tracker-and-partition-foreign",
        "partition-foreign"
      ]
    }
  }
}

Values

• Allow is a list of origins (not domains) where cookies are always allowed. You must include http or https. As of Firefox 154, using Allow to exempt sites from clearing on shutdown is deprecated. Firefox migrates origins to the new mechanism, but you should use SanitizeOnShutdown's Exceptions instead.
• AllowSession is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
• Block is a list of origins (not domains) where cookies are always blocked. You must include http or https.
• Behavior sets the default behavior for cookies based on the following values:
  • accept: Accept all cookies.
  • reject-foreign: Reject third party cookies.
  • reject: Reject all cookies.
  • limit-foreign: Reject third party cookies for sites you haven't visited.
  • reject-tracker: Reject cookies for known trackers (default).
  • partition-foreign: (Firefox 153) Reject cookies for known trackers and partition third-party cookies, also known as Total Cookie Protection (default for private browsing).
  • reject-tracker-and-partition-foreign: (Deprecated. Renamed to partition-foreign in Firefox 153. Update existing configurations to use partition-foreign.)
• BehaviorPrivateBrowsing sets the default behavior for cookies in private browsing. Accepts the same values as Behavior.
• Locked prevents the user from changing cookie preferences.
• Default: determines whether cookies are accepted at all. (Deprecated. Use Behavior instead)
• AcceptThirdParty determines how third-party cookies are handled. (Deprecated. Use Behavior instead)
• RejectTracker only rejects cookies for trackers. (Deprecated. Use Behavior instead)
• ExpireAtSessionEnd determines when cookies expire. (Deprecated. Use SanitizeOnShutdown instead)

Windows (GPO)

Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "partition-foreign"
Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "partition-foreign"
Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0

macOS

<dict>
  <key>Cookies</key>
  <dict>
    <key>Allow</key>
    <array>
      <string>http://example.com</string>
    </array>
    <key>AllowSession</key>
    <array>
      <string>http://example.edu</string>
    </array>
    <key>Block</key>
    <array>
      <string>http://example.org</string>
    </array>
    <key>Locked</key>
    <true/> | <false/>
    <key>Behavior</key>
    <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | partition-foreign</string>
    <key>BehaviorPrivateBrowsing</key>
    <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | partition-foreign</string>
  </dict>
</dict>