How to create session cookie ?

[brianp-das]

Hello everyone,

I'm currently implementing SSO for several apps, and one of the requirements is a "remember me" feature.

1. Persistent Session: If the user checks the "remember me" option, my IDP sets remember=true and remember_for=7200 in the request to the Hydra Accept Login endpoint. This correctly creates a persistent cookie.

2. Session-Only: However, if the user does not check this option, we expect Hydra to return a session-only cookie. This should ensure the cookie is cleared when the browser is closed.

It seems Hydra does not provide a straightforward way to create a pure session cookie (one without a Max-Age or Expires attribute). I have tried setting remember=true with remember_for=0, but Hydra still creates a persistent cookie with a Max-Age defaulted to 720h (the ttl.authentication_session value).

I might be missing something, but the official Ory documentation doesn't seem to mention how to achieve a non-persistent session cookie.

Does anyone have experience with this or know of a workaround?

Thanks,

[pratikrath126]

Hey! If you want a session-only cookie (no Max-Age/Expires), you should set remember: false when calling the acceptLoginRequest endpoint. When remember is false, Hydra treats the authentication session as non-persistent, and the browser should clear the cookie when it is closed.

If you set remember: true, Hydra will always assign a duration—either your remember_for value or the default ttl.authentication_session. Setting remember_for: 0 often defaults back to the global TTL rather than making it session-only.

Try switching to remember: false for those non-remembered logins and see if that gives you the browser-session behavior you are looking for!

[brianp-das]

Thanks @pratikrath126! When I set remember: false, Hydra doesn't create a non-persistent session cookie; instead, it explicitly expires it. The Set-Cookie header in the response looks like this:

ory_hydra_session=...; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; HttpOnly; Secure; SameSite=None

Consequently, when I navigate to the login route again while already authenticated, Hydra displays the login form. This confirms that the skip flag is false and the previous session was not preserved.