Magnolia 5.7 reached extended end of life on May 31, 2022. Support for this branch is limited, see End-of-life policy. Please note that to cover the extra maintenance effort, this EEoL period is a paid extension in the life of the branch. Customers who opt for the extended maintenance will need a new license key to run future versions of Magnolia 5.7. If you have any questions or to subscribe to the extended maintenance, please get in touch with your local contact at Magnolia.

Use the Cookies app to manage cookies that require consent from your website visitors.

The cookies you use on your website have different origins: some come from third-party services such as Google Analytics, others from Magnolia features. One example of a Magnolia cookie is the VISITOR cookie used by the visitor trait to serve personalized content.

App definition

The Cookies app is defined in a YAML file. This YAML file resides in the Magnolia Maven module called magnolia-privacy-ui, which is part of the Privacy module.

If you want to change the app definition, you can decorate it, create a copy in the resources workspace with the Resource Files app or create a copy in a file-based light module using the Magnolia resources origins loading order.


Read GDPR and cookies to understand how to use the Cookies app to set cookies according to website visitor consent.

Adding a cookie definition

Go to Tools > Cookies.

To add a new cookie, click Add cookie. New nodes can only be added to the root node (no nested cookies). The properties id (cookie's unique ID) and cookieName (cookie's name as seen in the browser) are mandatory.

Editing a cookie definition

To edit a cookie definition, select a cookie in the browser and click Edit cookie. The fields in the Cookie properties dialog correspond to the properties described below.

You can also edit cookie definitions directly in the Configuration app under /modules/cookie-manager/config.

Property nameDescription


Cookie's unique ID. The node name is used as the id. The identifier is required to get a CookieDefinition from the CookieManager. (See Data privacy API: Cookie manager.)



The name of the cookie as seen in the browser.



The value of the cookie.



The domain within which this cookie should be presented.



The path for the cookie to which the client should return the cookie.

Leave empty if the cookie should be valid just for the subtree of the active page. Use / if the cookie should be valid for whole domain.


optional, default is -1

The maximum age of this cookie (in seconds).

The default value -1 creates a cookie that expires when you shut down the browser.


optional, default is .+

A regular expression used to determine whether a cookie will be set or not.


optional, default is false

Indicates to the browser whether the cookie should only be sent using a secure protocol, such as HTTPS or SSL.


optional, default is true

HttpOnly cookies are not supposed to be exposed to client-side scripting code, and may therefore help mitigate certain kinds of cross-site scripting attacks.


optional, default is true

Set to false to disable the cookie definition.



This property cannot be edited using the Cookies app. Instead you must create localized i18n message keys for this property. The format of the i18n key is cookies.$cookiesId.comment.

All properties except requiredConsentRegexp and enabled derive from the Servlet Cookie API.

The implementation of the server-side set cookie calling cookieManager#addCookie may override the properties set in the Cookies app.

Magnolia-specific property requiredConsentRegexp

In addition to id and cookieName, the requiredConsentRegexp property is also crucial when configuring cookies.The value of the requiredConsentRegexp property is interpreted as a regular expression. The default value is .+.Server-side cookies are set if the regular expression matches the value stored in the cookieConsent_status cookie.

See GDPR and cookies: Understanding when cookies are set.

Bootstrapped cookie definitions

The Cookies app already contains some nodes. The exact content depends on the modules in your bundle. The following table lists the pre-configured cookie definitions you may find in Magnolia:

IDcookieNameUsageInstalled by
cookiesConsentcookieconsent_statusStores the cookie consent decision of the website visitor.magnolia‐privacy‐ui
(see Privacy module)
NEW_VISITORNEW_VISITORUsed by the visitor trait.Personalization module
weatherLocality_BaselweatherLocalityNot used. Can be used for a cookie trait.Personalization module
google_analytics_ga,_gidGoogle Analytics

Travel demo modules

tourType_anytourTypeTour type buttons on the Travel demo home page.Travel demo modules

(info) We don't recommend removing these nodes except those from the Travel demo module.