Cookies

Configure cookie preferences.

Values

• Allow is a list of origins (not domains) where cookies are always allowed. You must include http or https. As of Firefox 154, using Allow to exempt sites from clearing on shutdown is deprecated. Firefox migrates origins to the new mechanism, but you should use SanitizeOnShutdown's Exceptions instead.
• AllowSession is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
• Block is a list of origins (not domains) where cookies are always blocked. You must include http or https.
• Behavior sets the default behavior for cookies based on the following values:
  • accept: Accept all cookies.
  • reject-foreign: Reject third party cookies.
  • reject: Reject all cookies.
  • limit-foreign: Reject third party cookies for sites you haven't visited.
  • reject-tracker: Reject cookies for known trackers (default).
  • partition-foreign: Reject cookies for known trackers and partition third-party cookies, also known as Total Cookie Protection (default for private browsing).
  • reject-tracker-and-partition-foreign: (Deprecated. Renamed to partition-foreign. Update existing configurations to use partition-foreign.)
• BehaviorPrivateBrowsing sets the default behavior for cookies in private browsing. Accepts the same values as Behavior.
• Locked prevents the user from changing cookie preferences.
• Default: determines whether cookies are accepted at all. (Deprecated. Use Behavior instead)
• AcceptThirdParty determines how third-party cookies are handled. (Deprecated. Use Behavior instead)
• RejectTracker only rejects cookies for trackers. (Deprecated. Use Behavior instead)
• ExpireAtSessionEnd determines when cookies expire. (Deprecated. Use SanitizeOnShutdown instead)

Examples

policies.json

{
  "policies": {
    "Cookies": {
      "Allow": [
        "http://example.org/"
      ],
      "AllowSession": [
        "http://example.edu/"
      ],
      "Block": [
        "http://example.com/"
      ],
      "Locked": true,
      "Behavior": "accept",
      "BehaviorPrivateBrowsing": "accept"
    }
  }
}

JSON schema

Cookies JSON schema

{
  "type": "object",
  "properties": {
    "Allow": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "moz-url",
        "pattern": "^([Ff][Ii][Ll][Ee]://.*|[Hh][Tt][Tt][Pp][Ss]?://[^/]+/?)$"
      }
    },
    "AllowSession": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "moz-url",
        "pattern": "^([Ff][Ii][Ll][Ee]://.*|[Hh][Tt][Tt][Pp][Ss]?://[^/]+/?)$"
      }
    },
    "Block": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "moz-url",
        "pattern": "^([Ff][Ii][Ll][Ee]://.*|[Hh][Tt][Tt][Pp][Ss]?://[^/]+/?)$"
      }
    },
    "Default": {
      "type": "boolean"
    },
    "AcceptThirdParty": {
      "type": "string",
      "oneOf": [
        {
          "const": "always",
          "title": "Always"
        },
        {
          "const": "never",
          "title": "Never"
        },
        {
          "const": "from-visited",
          "title": "From visited sites only"
        }
      ]
    },
    "RejectTracker": {
      "type": "boolean"
    },
    "ExpireAtSessionEnd": {
      "type": "boolean"
    },
    "Locked": {
      "type": "boolean"
    },
    "Behavior": {
      "type": "string",
      "oneOf": [
        {
          "const": "accept",
          "title": "Accept all cookies"
        },
        {
          "const": "reject-foreign",
          "title": "Reject third-party cookies"
        },
        {
          "const": "reject",
          "title": "Reject all cookies"
        },
        {
          "const": "limit-foreign",
          "title": "Third-party cookies from visited sites only"
        },
        {
          "const": "reject-tracker",
          "title": "Reject known trackers"
        },
        {
          "const": "reject-tracker-and-partition-foreign",
          "title": "Reject known trackers and partition third-party cookies"
        },
        {
          "const": "partition-foreign",
          "title": "Partition third-party cookies"
        }
      ]
    },
    "BehaviorPrivateBrowsing": {
      "type": "string",
      "oneOf": [
        {
          "const": "accept",
          "title": "Accept all cookies"
        },
        {
          "const": "reject-foreign",
          "title": "Reject third-party cookies"
        },
        {
          "const": "reject",
          "title": "Reject all cookies"
        },
        {
          "const": "limit-foreign",
          "title": "Third-party cookies from visited sites only"
        },
        {
          "const": "reject-tracker",
          "title": "Reject known trackers"
        },
        {
          "const": "reject-tracker-and-partition-foreign",
          "title": "Reject known trackers and partition third-party cookies"
        },
        {
          "const": "partition-foreign",
          "title": "Partition third-party cookies"
        }
      ]
    }
  }
}

Windows (GPO)

Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "partition-foreign"
Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "partition-foreign"
Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0

macOS

<dict>
  <key>Cookies</key>
  <dict>
    <key>Allow</key>
    <array>
      <string>http://example.com</string>
    </array>
    <key>AllowSession</key>
    <array>
      <string>http://example.edu</string>
    </array>
    <key>Block</key>
    <array>
      <string>http://example.org</string>
    </array>
    <key>Locked</key>
    <true/> | <false/>
    <key>Behavior</key>
    <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | partition-foreign</string>
    <key>BehaviorPrivateBrowsing</key>
    <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | partition-foreign</string>
  </dict>
</dict>

Compatibility

	Firefox	Firefox ESR	Firefox Enterprise
Cookies	Available since 6060	Available since 6060	Available since 149149
RejectTracker	Available since 6363	Available since 6868	Available since 149149
AllowSession	Available since 7979	Available since 78.178.1	Available since 149149
Behavior	Available since 9595	Available since 91.491.4	Available since 149149

reject-tracker-and-partition-foreign renamed to partition-foreign in Firefox 153, using Allow to exempt sites from clearing on shutdown is deprecated in 154.

CCK2 Equivalent: N/A
OMA-URI: Cookies
Preferences Affected: network.cookie.cookieBehavior, network.cookie.cookieBehavior.pbmode, network.cookie.lifetimePolicy