Microsoft authentication uses session cookie to secure login data

SocietySocietyMarch 25, 2026 at 11:53 AM

Key Points

Microsoft's MSAL uses a session cookie to store an encryption key for securing authentication data in localStorage during login.
The specific authentication data secured, session cookie duration, and expiration triggers are not publicly disclosed.
The Heroma system primarily uses strictly necessary cookies, but optional cookie usage remains unclear.

The Microsoft Authentication Library (MSAL) sets a session cookie to store an encryption key used to secure authentication data stored in localStorage during the login process, as confirmed by official documentation. It is not publicly disclosed what specific authentication data is stored in localStorage and secured by this encryption key, nor how long the session cookie remains active or what triggers its expiration or renewal. In a separate context, cookies in the Heroma system are primarily strictly necessary cookies, according to official statements.

However, it remains unclear whether there are any optional or non-necessary cookies used in the Heroma system beyond the strictly necessary ones.