PACS Spark

Cookie Policy

PACS Spark sets only the cookies it needs to sign you in and keep your session secure. It does not use advertising, analytics or tracking cookies, and it shares nothing with third parties.

Cookie	What It Does	Lasts
authjs.session-token	Keeps you signed in after single sign on. It holds your session and nothing else.	8 hours
authjs.csrf-token	Checks that forms and requests really come from PACS Spark and not from another site.	Session
authjs.callback-url	Remembers the page you asked for so you land on it after you sign in.	Session
authjs.pkce.code_verifier, authjs.state and authjs.nonce	Protect the secure hand over between PACS Spark and Microsoft Entra ID while you sign in.	A few minutes

When PACS Spark is served over a secure connection, these cookie names carry a protective prefix such as __Secure- or __Host-. They work the same way.