---
schema_version: "1"
id: 38ec136a372494b97af47b4bb70d69ad3ee75d9cd5755dbd81de0b4c0532e963
title: OAuth 2.0 Hybrid App Flow Cookie Management
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oauth_hybrid_app_flow_cookies.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_hybrid_app_flow_cookies.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 8aeb08bbbbfbcb01e1041e91516f40cea73b29220c17f45347cbd9f213d0ef6d
description: When you use the OAuth 2.0 hybrid app token flow, you use scopes to request session IDs (SID) and domain values. You then use these SIDs and domain values to set browser cookies and establish sessions in your hybrid app. When you refresh your access token, you receive new SIDs and domains to reset the browser cookies.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OAuth 2.0 Hybrid App Flow Cookie Management

When you use the OAuth 2.0 hybrid app token flow, you use scopes to request session IDs (SID) and domain values. You then use these SIDs and domain values to set browser cookies and establish sessions in your hybrid app. When you refresh your access token, you receive new SIDs and domains to reset the browser cookies.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

Salesforce supports cookies that let you establish sessions with these domains.

- Primary Salesforce app via the `web` scope
- Content resources via the `content` scope
- Lightning apps via the `lightning` scope
- Visualforce pages via the `visualforce` scope

The `web` scope is a prerequisite to use the hybrid app flow—at minimum, your hybrid app must be able to access your primary Salesforce domain. To access content resources, Lightning apps, and Visualforce domains, assign their associated scopes in addition to the `web` scope. For example, to access Lightning domains, assign your external client app or connected app the `web` and `lightning` scopes.

In all scenarios, you receive the `sidCookieName`, `cookie-sid_Client`, and `cookie-ClientSrc` values. These values are tied to the `web` scope.

When you use the hybrid app refresh token flow, you receive new return values that you use to reset the session cookies.

This table summarizes the return parameters you receive for each scope.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d30052e128">Scope</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d30052e131">Return Parameters</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Scope" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e128 ">
            <code>web</code>
          </td>

          <td data-label="Return Parameters" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e131 ">
            <ul>
              <li>
                <code>sidCookieName</code>
              </li>

              <li>
                <code>cookie-sid_Client</code>
              </li>

              <li>
                <code>cookie-ClientSrc</code>
              </li>

            </ul>
          </td>

        </tr>
        <tr class="">
          <td data-label="Scope" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e128 ">
            <code>content</code>
          </td>

          <td data-label="Return Parameters" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e131 ">
            <ul>
              <li>
                <code>content_sid</code>
              </li>

              <li>
                <code>content_domain</code>
              </li>

            </ul>
          </td>

        </tr>
        <tr class="">
          <td data-label="Scope" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e128 ">
            <code>lightning</code>
          </td>

          <td data-label="Return Parameters" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e131 ">
            <ul>
              <li>
                <code>lightning_sid</code>
              </li>

              <li>
                <code>lightning_domain</code>
              </li>

              <li>
                <code>crsf_token</code>
              </li>

            </ul>
          </td>

        </tr>
        <tr class="">
          <td data-label="Scope" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e128 ">
            <code>visualforce</code>
          </td>

          <td data-label="Return Parameters" class="slds-cell-wrap" style="vertical-align:top;" headers="d30052e131 ">
            <ul>
              <li>
                <code>visualforce_sid</code>
              </li>

              <li>
                <code>visualforce_domain</code>
              </li>

            </ul>
          </td>

        </tr>
      </tbody>
    </table>

## Hybrid App Flow Cookie Examples

These examples illustrate the browser cookies that are set when you use the `web`, `content`, `lightning`, and `visualforce` scopes.

When you assign the `web` scope to request a web session in the Salesforce org’s primary domain, these cookies are set in the browser. ![Cookie values set by web scope](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/sid_main.png)

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Because the `web` scope is a prerequisite for the `content`, `lightning`, and `visualforce` scopes, the cookies in this example are set every time you use the hybrid app flow.

When you assign the `content` scope, this cookie is set.

![Cookie set by content scope](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/sid_content.png)

Assigning the `lightning` scope sets this cookie.

![Browser cookie set by lightning scope](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/sid_lightning.png)

And when you assign the `visualforce` scope, this cookie is set.

![Browser cookie set by visualforce scope](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/sid_visualforce.png)