Cookies used by Lime Forms

Lime Forms sets two cookies of its own: simpliform_session and XSRF-TOKEN. If a form uses the Google reCAPTCHA integration, Google sets an additional cookie.

Cookie	Set by	Domain	Lifetime	Purpose
`simpliform_session`	Lime Forms	Your Lime Forms address (for example `yourcompany.lime-forms.com`)	8 hours	Session ID
`XSRF-TOKEN`	Lime Forms	Your Lime Forms address	8 hours	Cross-site request forgery protection
`_GRECAPTCHA`	Google	`www.google.com`	6 months	reCAPTCHA risk analysis

Lime Forms standard cookies

Both cookies are set on the exact address the form is served from, for example yourcompany.lime-forms.com. They are not shared with other subdomains. Both are only sent over HTTPS (Secure), and their values are encrypted.

Embedded forms

When a form is embedded on another website, the cookies still belong to your Lime Forms address, not to the website the form is embedded on. To the visitor's browser they are therefore third-party cookies. Browsers that block third-party cookies, such as Safari, do not store them. The form still works without them.

simpliform_session

simpliform_session Contains a session ID

simpliform_session

The session cookie stores the session identifier (session ID) of a visitor.

When a visitor opens a form, the server creates a unique session ID to keep track of the visitor's state across requests.
The session ID is stored in this cookie and sent back to the server with later requests, which lets the server find the session data that belongs to it.
For forms, the session is used to stop the same submission from being sent twice.
The cookie is HttpOnly, so scripts on the page cannot read it.

XSRF-TOKEN

XSRF-TOKEN Contains a cross-site request forgery token

XSRF-TOKEN

The XSRF-TOKEN cookie (often called a CSRF token, for Cross-Site Request Forgery) is used to protect against CSRF attacks.

Laravel, the framework Lime Forms is built on, generates a token for each session and sends it in this cookie.
The token protects actions performed by signed-in users in the Lime Forms admin. A request that changes data must carry the token, so the server can check that it comes from the user's own browser and not from a malicious site.
Public form submissions do not depend on this token.

Google reCAPTCHA integration cookies

These cookies only apply to forms that have reCAPTCHA turned on.

Lime Forms loads the reCAPTCHA widget from www.google.com, so Google's cookies are set on the www.google.com / google.com domain. Loading reCAPTCHA from www.recaptcha.net instead is not currently supported.

The Lime Forms server checks the visitor's reCAPTCHA answer by calling Google directly. That call goes from server to server, so it does not set or read any cookies in the visitor's browser.

_GRECAPTCHA

_GRECAPTCHA Used for risk analysis

_GRECAPTCHA

reCAPTCHA sets this cookie, which Google describes as necessary, to provide its risk analysis.

It is set when the visitor interacts with the reCAPTCHA checkbox, not when the form loads.
It is set on www.google.com (path /recaptcha) and lasts for 6 months.

Other google.com cookies

Because the widget is loaded from www.google.com, visitors who already have Google cookies in their browser (for example from using Google Search) send them along when the widget loads. Neither Lime Forms nor reCAPTCHA sets these cookies: a visitor without existing Google cookies only gets _GRECAPTCHA. Cookies that commonly appear include:

AEC Google security cookie

AEC

Google uses the AEC cookie to detect spam, fraud and abuse. The AEC cookie lasts for 6 months.

NID & __Secure-ENID Functionality cookies

NID & __Secure-ENID

Google uses the NID and __Secure-ENID cookies to remember preferences and other information, such as preferred language and how many search results to show per page. The NID cookie expires 6 months after its last use. The __Secure-ENID cookie lasts for 13 months.

SOCS User state cookie

SOCS

The SOCS cookie stores a user's choices about cookies. The SOCS cookie lasts for 13 months.