Cookies
Nextcloud only stores cookies that are necessary for it to function. All cookies are set by your Nextcloud server directly — no third-party cookies are involved.
Under GDPR, only cookies that store or transmit personal data require a legal basis or consent. Of the cookies listed below, only the remember-me cookies contain personal data (the username). All other cookies contain randomly generated tokens with no inherent personal information.
提示
The
__Host-prefix is applied to the same-site cookies only when Nextcloud is accessed over HTTPS. On plain HTTP the prefix is omitted and the cookies are namednc_sameSiteCookiestrictandnc_sameSiteCookielax.
Cookies stored by Nextcloud
| Type | Name | Purpose | Personal data | Lifetime |
|---|---|---|---|---|
| Session cookie | <instance_id> |
Carries a random PHP session ID used to identify the user's session on the server. | No | Until browser is closed. |
| Session cookie | oc_sessionPassphrase |
Carries a random token used to decrypt the session data stored on the server. | No | Until browser is closed. |
| Same-site cookie | __Host-nc_sameSiteCookiestrict |
Used to detect whether a request originates from the same site (SameSite=Strict). Helps prevent CSRF attacks. Contains no user information. |
No | Expires 2100-12-31 (effectively permanent). |
| Same-site cookie | __Host-nc_sameSiteCookielax |
Used to detect cross-site navigation requests (SameSite=Lax). Helps prevent CSRF attacks. Contains no user information. |
No | Expires 2100-12-31 (effectively permanent). |
| Remember-me cookie | nc_username |
Stores the user's login name to enable persistent login across browser sessions. | Yes — contains the username. | Defaults to 15 days. Configurable via remember_login_cookie_lifetime. |
| Remember-me cookie | nc_token |
A random token paired with nc_username to authenticate the persistent login without storing the password. |
No | Same as nc_username. |
| Remember-me cookie | nc_session_id |
The original session ID, retained to allow session continuity when the remember-me token is used. | No | Same as nc_username. |
| Download helper | ocDownloadStarted |
A short-lived random token set when a file download begins, used to signal the browser that the download has started (e.g. to hide a loading indicator). | No | 20 seconds. |
Remember-me cookies
The remember-me cookies (nc_username, nc_token, nc_session_id) are only set when the user explicitly selects Remember me at login. They are cleared immediately when the user logs out.
Because nc_username contains the user's login name, it is personal data under GDPR. The legal basis for storing it is typically legitimate interest or contract performance (enabling the service the user has requested), provided the user has been informed of this in your privacy policy.
The lifetime defaults to 15 days and can be shortened in config/config.php:
'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15,
谢谢你的反馈！