Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Is there a Cloudflare setting that corresponds to the creation of the __cfduid session cookie?

I'm currently trying out CF; mostly for the neat DNS management and the implicit CDN. But the basic WAF is possibly just as nice an addition atop Apaches mod_security/CRS. However I'm not sure what said cookies purpose is, and would prefer to get rid of that.

The most obvious setting

Security profile: Essentially off

Seems to also have essentially no effect on the creation of __cfduid with every HTTP response. The cookies purpose is presumably for opting out single users from firewall rules, repeated cloudflare captchas, etc.

Their support documentation alludes to that. Where the first revision from 09/2012 (https://support.cloudflare.com/hc/en-us/articles/200169536-What-does-the-cfduid-cookie-do-) says this behaviour can't ever be turned off. An entry two months later 11/2012 (https://support.cloudflare.com/hc/en-us/articles/200170156-What-does-the-CloudFlare-cfduid-cookie-do-) however omits that note.

While Cloudflares TOS itself check out as plausible, this cookie has all the properties of a tracking session, dc41f5a78bc3e27d44b70fca4606e4262283407700773. The excessive cookie lifetime of 6 years is very odd for the exemplary internet cafe visitor use case. And since I'm personally avoiding needless sessions, and don't want to plaster a privacy note (in light of the infamous EU cookie law) like everyone else, I'd prefer to have it gone per default.

A workaround like:

  Header add Set-Cookie "__cfduid= ; path=/; domain=.example.org; HttpOnly"

Does eschew its storage, but retains two needless headers, and doesn't seem overly reliable.

So, is there another CF setting for this?

share|improve this question

1 Answer 1

No, there is no way to turn the cookie off if we are proxying the record (if you had a subdomain not running through our proxy in your DNS settings, then we wouldn't add the cookie because it is going direct to your server). The cookie is basically what makes security (like a challenge page) work.

share|improve this answer
"Makes security work" is still vastly indescriptive. How does it aid security against e.g. bots which aren't typically sending session cookies along? If it's just for CAPTCHAS then what's the excessive cookie expiry time for? –  mario Mar 18 at 18:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.