Khoros Cookies Datasheet (Communities, Care, and Marketing)

[#1]

Cookies are small data files stored in web browsers to track usage and enable useful services and features on Khoros Communities. This document provides information on the standard cookies set by Khoros Communities and how to reject or delete those cookies should users choose to do so. Understand that restricting cookies can have an adverse impact on the functionality and the online user experience on the Community.

We classify the cookies typically found on Khoros communities into the four broad categories described below.  

Type	Classification	Description	Example
1	Strictly necessary	These cookies are necessary for the proper functioning of the community, such as tracking a user session, or accessing secure areas.	Session cookie used to pin a logged-in session to a browser
2	Performance	The information these cookies collect is anonymous and is used to collect aggregate data including information about the pages users visit.	Cookies delivered by Omniture WebAnalytics and Google Analytics for purposes of aggregate reporting
3	Functional	These cookies allow websites to remember preferences and settings, such as your username, language, region, font size, and so on.	Cookie used to hold a user’s username as part of a “remember me” feature
4	Tracking, targeting and sharing	These cookies remember that you've visited a website, a particular web page, and/or track your activities on the site. This information is sometimes shared with third party advertisers for serving targeted online advertising or other personalized content.	Cookies used to track visitor activity on an individual basis can be used by Khoros or its third party business partners to serve personalized content, and/or later aggregated and used to analyze website traffic and trends.

How to control cookies

Some cookies are necessary for the proper operation of the Community and disabling or removing them may have an adverse impact on the proper functioning and user experience. However, users may choose to view, block, or remove cookies set by Khoros Community through their web browser settings (or any website cookies for that matter). Consult the help feature for your specific browser to find how. Here are some useful links for your convenience.

• Microsoft Internet Explorer Privacy Settings and Information
• Google Chrome Privacy Settings and Information
• Mozilla Firefox Privacy Settings and Information
• Apple Safari Privacy Settings and Information

Also, you may choose to consult an external and independent third party website such as AboutCookies.org or www.youronlinechoices.eu/ if you are in the European Union which provides comprehensive information on a variety of browsers and how to control or change their respective privacy settings.

Cookies used by Khoros

The following standard cookies are used by:

• Khoros Communities
• Community Analytics
• Khoros Care
• Khoros Marketing
• JX

Turning off or removing these cookies may have an adverse impact on the proper functioning and user experience on the Community.

Khoros Communities cookies

Cookie Name	Type	Description and Purpose	Expiration Time/Type	If removed, disabled, or not accepted
AWSALB	1	AWS sticky session cookie required for load balancer routing. See this document for further information.	Session	Sticky session won't work and some functionality will break.
AWSALBCORS	1	For continued stickiness support with CORS use cases after the Chromium update, we are creating additional stickiness cookies for each of these duration-based stickiness features named AWSALBCORS (ALB). See https://forums.aws.amazon.com/ann.jspa?annID=7413 for further information.	Session
_ga	2	Distinguishes users using a unique ID. It is used by Google Analytics to calculate visitor, session, and campaign data. By default, the configuration setting that sets this cookie is disabled. File a Support ticket to request enablement.	2 years (persistent)	Visitor and session data will not be tracked and will not be available to Google Analytics
!lithiumSSO:{client_id}	1	Used for passing authentication information to Khoros	session	SSO will not be functional for the user
LiSESSIONID	1	Session management	session	User cannot log in, and is treated as an anonymous user
­­lia.anon.{setting or config name}	3	Stores community-wide configurations and settings for anonymous users	1 year (persistent)	Community behavior will follow defaults and any UI convenience changes made by the user will be ignored.
liSdkOptions:{communityId}	3	Dropped when a Studio user navigates to Studio > Advanced > SDK and clicks Submit after checking the View as anonymous checkbox. The cookie allows developers to sign out of the community but still have it find the URL to use for rendering a skin that is hosted via the Community Plugin SDK. This cookie is used only on stage sites.	1 month or when the View as anonymous checkbox is unselected	The community will serve the URL for the skin set on the stage site instead of the URL to the locally hosted skin (so local SASS development will not work when the user is signed out)
lithium.anonymous. usersetting.{setting name}	3	Remembers user preferences	1 year (persistent)	The community will not remember the user’s setting preferences
lithium.anonymous. usersetting.profile. language	3	Remembers language preferences	1 year (persistent)	The community will not remember the user’s language preferences. The language will default to the native language defined for the community.
lithiumLogin:{community id}	3	Keeps users logged in when they make a request after their session has expired. It is triggered when a user checks Save login name and password. The cookie is encrypted and includes a unique user secure ID in the database.	30 days (persistent)	The "auto login" and "remember me" features will not work
LithiumNotifications	3	Temporarily stores Realtime Notification messages (Toast messages)	session	Realtime notification toasts may not appear (pop-up) after a page transition.
LithiumUserInfo	1	Session management	session	The user will not be able to view secure pages and will be redirected to the login page
LithiumUserSecure	1	Secure Session  management	session	The user will not be able to view secure pages and will be redirected to the login page.
LithiumVisitor	1	Replaces VISITOR_BEACON. Khoros currently uses both for backward compatibility. This cookie computes billing visits, registered billing visits, visits, registered visits, and unique visitors metrics. The cookie is encrypted and stores when it was first issued, when it was last seen by Khoros, an unique visitor ID (which is unique per visitor’s browser).	Configurable (Default = 10 years)  Note: To change the default value, contact Khoros Support.	Visits and unique visitors metrics will not be accurate. There will be a new billable visit on each new request. Customers on billing visits model will be affected.
P{poll_id}U{user_id}R{reset_count}	3	Tracks when a user has voted in a poll and tracks the answer value. The cookie is used to prevent a user from voting multiple times in a single poll. The cookie is only placed if Use cookies to prevent multiple votes is enabled in Community Admin.	1,000000+ days (persistent)	If the user is an anonymous user, the user will be able to vote multiple times when the cookie is cleared. If the user is logged in, votes, and then clears the cookie, they are not allowed to revote.
PushyAuthToken	1	Authenticates the user for a session with Realtime Notifications service (Pushy)	Manually cleared when the user logs out or when their session expires due to inactivity	WebSocket connections to the Realtime Notification service will fail with a 403 Forbidden error and the user will not see realtime notifications.
VISITOR_BEACON	1	Computes billing visits, registered billing visits, visits, registered visits, and unique visitors metrics. The cookie is encrypted and stores, when it was first issued, when it was last seen by Khoros, the user ID, and its own unique ID.	Configurable (Default = 10 years) Note: To change the  default value, contact Khoros Support.	Visits and unique visitors metrics will not be accurate. There will be a new billable visit on each new request. Customers on billing visits model will be affected.
VISITORID	1	Distinguishes between human and bot traffic	3 years (session)	Defeats the bot detection mechanism. (May see increased spam on the community.)
ValueSurveyParticipation	3	Stores a timestamp storing the creation time of this cookie, which is used in value survey trigger logic.	Default is 90 days. Configurable in Community Admin	The user will get multiple prompts to take a survey
ValueSurveyVisitorCount	3	Stores the survey visit count of the user, which is used in logic that determines when a survey is triggered. This cookie is used in conjunction with the ValueSurveyParticipation cookie. When the ValueSurveyParticiation is set, the count for ValueSurveyVisitorCount cookie is reset to 0.	Expires when the ValueSurveyParticipation cookie is either set or expires	The user will not be prompted to take a survey until the count defined in the Delay before prompting user with survey field in Community Admin > Features > Value Surveys > Settings is met.
LithiumCookiesAccepted	3	Stores the information of whether the user has given the explicit consent by clicking OK on the cookie banner to drop Type 2, Type 3 & Type 4 cookies. This cookie will store ‘true’ if the user has explicitly clicked OK in the cookie banner.	Ten years (persistent). This cookie is not session specific and will be maintained across sessions.	This cookie is not governed by any separate config or setting. Hence it cannot be disabled. But if removed from the browser, the cookie banner will appear again and type 2, type 3 & type 4 cookies will not be dropped unless the user clicks on OK again
_pendo_meta.*	4	Cookie is used by Communities to show in-app feature guides in the "Community Admin" section	Persistent	None
_pendo_accountId.*	4	Cookie is used by Communities to show in-app feature guides in the "Community Admin" section	Persistent	None
_pendo_visitorId.*	4	Cookie is used by Communities to show in-app feature guides in the "Community Admin" section	Persistent	None

Community Analytics cookies

Cookie Name	Type	Description and Purpose		Expiration Time/Type	If removed, disabled, or not accepted
SIP|ws	3	Tracks the workspace to redirect to after a session timeout		1 day
All Khoros Community cookies also apply to Community Analytics

Khoros Care cookies

Khoros Care Cookies
Cookie Name	Type	Description and Purpose	Expiration Time/Type	If removed, disabled, or not accepted
X-TOKEN-ID	1	Protects against cross-site scripting	Session	This is a security token. It is critical for the application to run
PLAY_SESSION	1	This is the main session cookie	Session	This is the main session cookie. It is critical for the application to run
__sdx_page	3	Stores the user’s current application tab	14 days	When a user reloads the page, the user is redirected to the default tab instead of to the last tab used in the application
PLAY_LANG	3	Retrieves the user’s language	14 days	This is used only when LSW cannot detect the browser language and a user has no language set
Khoros Care Analytics Cookies
Cookie Name	Type	Description and Purpose	Expiration Time/Type	If removed, disabled, or not accepted
XSessionID	1	This is the main session cookie	24 hours	This is the main session cookie. It is critical for the application to run
JSESSIONID	3	This is an auto-generated JSP cookie	Session	The application does not rely on this cookie but uses the cookie occasionally to auto-generate UUIDs
Care Publisher Cookies
Cookie Name	Type	Description and Purpose	Expiration Time/Type	If removed, disabled, or not accepted
TOCOMA-CID	1	The user’s main session cookie	Expires when the browser session ends	The application will not run

Khoros Marketing cookies

Note: Khoros Experiences customers can set additional cookies on websites where they publish visualizations created by the Khoros product, in addition to the standard cookies disclosed below. These cookies are set by social networks when a user signed in to the social network visits the website.

Cookie Name	Type	Description and Purpose	Expiration Time/Type	Consequence if removed, disabled, or not accepted
sf-ui.login.spredfast.com	3 - Functional	Expanded user auth info	Persistent	None
sfauth-login.spredfast.com	1 - Strictly necessary	User Auth Info	12 hours	Users cannot use the products
sfjwt-login.spredfast.com	1 - Strictly necessary	User Auth Info	12 hours	Users cannot use the products
sfcsrf-login.spredfast.com	1 - Strictly necessary	Cross-site request protection	12 hours	Users cannot use the products
sfsig-login.spredfast.com	1 - Strictly necessary	User Auth Info signature	12 hours	Users cannot use the products
_ga	2- Functional	Google Analytics - Used to distinguish users.	2 years	None
_gid	2- Functional	Google Analytics - Used to distinguish users.	24 hours	None
_gat	2- Functional	Google Analytics - Used to throttle request rate. If Google Analytics is deployed via Google Tag Man...	1 minute	None
_pendo_accountId.*	4 - Tracking, targeting and sharing	Cookie is used by marketing software for user analytics	Persistent	None
_pendo_meta.*	4 - Tracking, targeting and sharing	Cookie is used by marketing software for user analytics	Persistent	None
_pendo_visitorId.*	4 - Tracking, targeting and sharing	Cookie is used by marketing software for user analytics	Persistent	None
PHPSESSID	1 - Strictly necessary	Only contain a reference to a session stored on the web server. No information is stored in the user's browser and this cookie can only be used by the current web site.	Session	Users cannot use the product
csrf_token	1 - Strictly necessary	Cross-site request protection	Session	Users cannot use the product
campaignTab	3 - Functional	Used to track and restore last tab in Initiative Settings	Session	None
_tweetriver_session	1 - Strictly necessary	Only contain a reference to a session stored on the web server. No information is stored in the user's browser and this cookie can only be used by the current web site.	24 hours	Users cannot use the product
_tweetriver_session	1 - Strictly necessary	Only contain a reference to a session stored on the web server. No information is stored in the user's browser and this cookie can only be used by the current web site.	24 hours	Users cannot use the product
mr_inst_token	3 - Functional	Allows users to like an Instagram status from Vizzes	Session	Users cannot like an Instagram status from Vizzes
mr_pauth_t	1 - Strictly necessary	Redirects the user after photo share	Session	User will not be redirected after sharing a photo
poll-user-id	3 - Functional	Tracks a random user id for submitting to a poll (so repeat votes can be tracked).	Session	Duplicate poll votes cannot be tracked.
redirectToOldModeration	3 - Functional	Redirects the user to old stream moderation tool	Session	May be deprecated or non-functioning at this time

Customer and third-party cookies on Khoros communities

Khoros customers may set additional cookies on Khoros Community in addition to the standard cookies disclosed above. These cookies are set and controlled by Khoros customers and their affiliates for various purposes such as website usage tracking (very common practice) and targeting for surveys or advertising in some cases. Khoros does not control the dissemination of such cookies. If you need more information on which additional cookies are set on the Community you are visiting, visit the community’s privacy section. You may also wish to review the How to control cookies section to view, remove, or block certain cookies. Note that disabling or removing cookies may have an adverse impact on the proper functioning of the community, and certain features may become disabled or unavailable.

Cookies set by third-party and external sites

Communities may contain embedded images, videos, and links to external and third-party websites. Khoros customers may also include syndicated content on their communities such as banner ads and similar embedded objects from their affiliates and partners. As a result, when you click on such an object you may be presented with cookies from the owner of that respective website where the content is hosted. Khoros does not control the dissemination of such cookies. Contact the relevant third party website for their privacy policy and cookie information. Note that disabling or removing cookies may have an adverse impact on the proper functioning of the community, and certain features may become disabled or unavailable.

Cookies used on JX communities

Khoros recently acquired the Jive-x community business and rebranded those communities as JX. JX communities use the following cookies:

Cookie Name	Description and Purpose	Possible Values	Type	Expiration Time/Type
anonymous	Used only by the Gamification module. Tracks if the user is authenticated or not.	true or false	3	one year
BIGipServer	Cookies prefixed with BIGipServer help to efficiently route internal traffic, and contain encoded addresses of internal Jive servers. These addresses are strictly internal, and cannot be used to connect to internal servers from the Internet. Altering the values of the cookie will not have any effect. For more information about these cookies, see the article Overview of BIG-IP persistence cookie encoding on the F5 Support site.		2
clickedFolder	This cookie is used in the Admin Console to persist the open/closed status of the current folder as used in various tree-view portions of the Admin Console.	string, true, or false.	1	at session end
containerSecurityToken	Used for RPC and Proxy Calls (Shindig Token) in loading app data in iFrames	String, alphanumeric	1	configurable, defaults to 1 hour
highlightedTreeviewLink	This cookie is used in the Admin Console to persist the current folder as used in various tree-view portions of the Admin Console.	integer, the DOM ID of the clicked folder.	1	at session end
jive-cookie	This cookie is used in the Admin Console to temporarily persist an encrypted username/password when creating a bridge between two sites. The information in the cookie is first encrypted with AES/256 encryption and then Base64 encoded.	string, Base64 encoded, encrypted username/password of remote site.	1	at session end
jive_default_editor_mode	This cookie is used on the front-end for guest/anonymous users who choose to use an editor mode other than the default editor mode.	string, advanced	3	30 days
jiveLocale	This cookie is used on the front-end for guest/anonymous users who choose a locale setting.	string, locale code	3	30 days
jive.login.ts	Stores the time stamp of the user's last login.	epoch time in ms	1	at session end
jive.login.type	Stores the type of login that was performed, either true native JX login or via SSO	String, either "form" or "saml"	1	30 days
jive.mobile.redirect	This cookie retains the user's selection for opening content in the Jive Mobile Web app or the Jive Native App when using a mobile device. Currently supported for iOS devices only.	WEB, NATIVE	3	one month
jiveRegularLoginUserCookie	This cookie is used to auto-redirect the login screen to the built-in authentication page (if the value exists and is set).	true	1	one month
jive.saml.passive.tried	This cookie is used to mark when SAML passive authentication has already been attempted.	true	1	3600 seconds (one hour)
jive.security.context	This cookie is the authentication context for the user.	the user's encrypted security contex	1	30 minutes unless refreshed. Same as the standard servlet container session timeout
jive.server.info	This cookie is used on the front-end in combination with Content Distribution Networks (CDN) like Akamai to associate the user with a specific server (also known as "session affinity").	string, a combination of the serverName, serverPort, contextPath, localName, localPort, and localAddr	1	at session end
jiveSSOLoginUserCookie	This cookie is used to auto-redirect the SSO screen to the built-in authentication page (if the value exists and is set).	true	1	one month
jiveTimeZoneID	This cookie is used on the front-end for guest/anonymous users who choose a timezone setting.	string, timezone ID	3	30 days
jive.senttoidp	Used to indicate whether a user has logged in with an SSO authority, used in conjunction with the "require explicit first time login" feature	string, true	3	30 days
jive.user.loggedin	This cookie is used on the front-end in combination with Content Distribution Networks (CDN) to denote the status of the current request.	string, true if the current request originates from a browser where the user is logged in	1	at session end
jive_wysiwygtext_height	This cookie is used on the front-end to persist the height of the editor window across sessions	integer, the height in pixels of the editor after the user chooses to expand the editor window	3	one year
JSESSIONID	This cookie is used on the front-end and the Admin Console to identify a session. It is part of the Java Servlet specification.	string, the unique token generated by Apache Tomcat	1	at session end
linkedin_oauth_	This cookie is used to communicate and authenticate with LinkedIn.		1
place_info	This cookie is used to temporarily store the tile configuration information when a user is configuring a tile that integrates with a third-party system, such as Salesforce. After the user clicks Save in the place template editing interface, the cookie is destroyed.	string, encoded representation of the place type and place id	1	after place template changes are saved
skin.palette.preview	This cookie is used to preview the site with an unpublished template.	ID (long value) of the template	1	long lived. 30 days
SPRING_SECURITY_REMEMBER_ME_COOKIE	This cookie is used on the front-end as part of the security authentication process to denote whether or not the user wants to have their credentials persist across sessions. It is part of the Spring Security specification; details are available here.	string, the Base64 encoded username and expiration time combined with an MD5 hex hash of the username, password, expiration time, and private key.	1	defaults to 14 days
X-JCAPI-TOKEN	Legacy csrf token, only in use in the mobile apps, set only to provide backwards compatibility	String, random with 8-character length	1	1 year

Contact Khoros

• For Privacy related requests email privacy [at] khoros [dot] com. Use a secure communication method such as PGP or SMIME for sharing sensitive information.
• Find Khoros's Privacy Policy at http://www.lithium.com/privacy.
• For Security related requests email security [at] khoros [dot] com. Use a secure communication method such as PGP or SMIME for sharing sensitive information.
• Read about our Security Testing and Reporting Policy at https://www.lithium.com/security.
• For sales related and general inquiries, contact your designated Account Manager or visit our website at http://www.lithium.com

[luk]

@SuzieH Do you know if the 

lithium.anonymous.usersetting.<setting.name>

cookie is still used by the current version of Lithium or if all the setting cookies for anonymous users were moved/migrated to

lia.anon.<setting.name>

cookies?

If both variations are still in use, could you elaborate on the difference and how/when/where they would be created (e.g. what action of an anonymous user would trigger cookie creation)?

It furthermore seems, that certain URL parameters seem to trigger some action that will then create cookie(s), but not always, for example:

https://<community>.tld?profile.language=fr

will create a cookie

lia.anon.profile.language (with value "fr")

if the value in the URL param is changed, the value will change in the cookie as well, BUT ONLY when not logged in / anonymous. We discovered this, because we had very strange behaviour in a multi language community. When users log out (which is when that cookie kicks in) and they have been in another language part of the community before they logged in, they will stay in the section of the community the logged out from, but their UI will change to the language of the community section they have visited before logging in, resulting in a mix of languages.

The question is: Is it a general "feature" that global settings for anonymous users can be set via URL parameters (that will then be saved into cookie values) or is this a bug or some other sort of functionality I'm not aware of?

Also, when does the cookie writing happen, the code handling it seems to run AFTER the page init script and therefore overrides any language specific logic that is performed there.

Third, is there a possibility (probably trough support) to enable/disable that cookie setting logic for certain settings?

[CeliaB]

Hi! I have forwarded your questions to Rahul Hari in product management for response.

[luk]

@CeliaB thank you!

[Lindsey]

Where is the configuration setting that sets the _ga cookie?

[luk]

@Lindsey don't expect to many answers here...see my question above from last year^^

[SuzieH]

Hi @luk. I didn't see that @RahulHa never got back to you. Let me see what I can do. @Lindsey I'm also going to try to track down your answer as well.

[Lindsey]

Thank you! @SuzieH 

[SuzieH]

Hi @Lindsey. The configuration setting that enables the _ga cookie is an internal config that must be enabled by Khoros Support. Please file a Support ticket and request that they enable the GoogleAnalytics config for your community.

[Lindsey]

@SuzieH ok, I figured it might be internal since I could not find it anywhere. Thank you!

[SuzieH]

@luk You probably no longer need this, but here is what Engineering replied with regarding lithium.anonymous.usersetting.<setting.name>. Hopefully, the information will be useful to someone in the future.

Do you know if the "lithium.anonymous.usersetting.<setting.name>" cookie is still used by the current version of Lithium or if all the setting cookies for anonymous users were moved/migrated to "ia.anon.<setting.name>"cookies? 

Community honours only “lia.anon.*”

Default set of settings allowed with the above cookie - 

0 = "community.browser_support_alert_dismissed"

1 = "config.search_auto_complete_enable"

2 = "integratedprofile.cta_add_topics_dismissal_timestamp"

3 = "integratedprofile.cta_connect_slim_dismissal_timestamp"

4 = "integratedprofile.cta_connect_wide_dismissal_timestamp"

5 = "integratedprofile.cta_manage_topics_dismissal_timestamp"

6 = "integratedprofile.cta_personalized_feed_dismissal_timestamp"

7 = "integratedprofile.my_interests_dismissal_timestamp"

8 = "layout.linear_in_thread_sort"

9 = "layout.threading_order"

10 = "p13n.cta.recommendations_feed_dismissal_timestamp"

11 = "profile.enable_search_before_post"

12 = "profile.kudos_giver_leaderboard_time"

13 = "profile.kudos_message_leaderboard_time"

14 = "profile.kudos_user_leaderboard_time"

15 = "profile.language"

16 = "profile.stream_discussion_style"

17 = "profile.stream_display_type"

18 = "profile.stream_sort_order"

19 = "profile.url_homepage"

Is it a general "feature" that global settings for anonymous users can be set via URL parameters (that will then be saved into cookie values) or is this a bug or some other sort of functionality I'm not aware of?

It is a general feature, enabled by default through an internal config. This is enabled by default, but it can be changed via a Support ticket.

is there a possibility (probably trough support) to enable/disable that cookie setting logic for certain settings?

It is either completely enabled or disabled; individual cookie configs aren’t available

[STARFLEET]

Hi guys,

although i have already created a dedicated support ticket, i guess this could be also relevant for the community:

We are facing issues in regards to the "Share"-Button of Khoros. As you might already know, Khoros is using AddThis functionality for sharing articles and posts.

AddThis already updated there solution in regards to being compliant with the GDPR ruleset and once a user is clicking they explicit consent of a user is asked for.

The Problem:
Every Khoros Layout including the Share Button component will already set AddThis related cookies, before the user is clicking on the share-Button and before the user has any chance to give consent. From a GDPR perspective this is really critical.

To give you a proof that the mentioned cookies are not related to one of our communities, here is a link for an article within this Khoros community:

https://community.khoros.com/t5/Khoros-Community-Discussions/NPS-other-survey-methodology/td-p/56440...

When visiting the mentioned url, you can easily find the cookies __atuvc and __atuvs belonging to AddThis and before you clicked any share button.

Both mentioned cookies are also not listed here in the cookie policy, as it is a cookie set by AddThis not directly via Khoros.

But it will be delivered via the Khoros pages and this makes it again critical.

STARFLEET

[RahulPa]

@STARFLEET 

Our engineers have already come up with a way to hide these cookies. The visibility of these cookies (__atuvc and __atuvs) was treated as a bug and the fix is available in v20.5 of the community so these cookies will not be visible in the browser's dev tools after v20.5 upgrade.