Cookies

Apart from HTTP requests and headers, Dynatrace Real User Monitoring (RUM) also relies on browser cookies to correlate user interactions in the browser, such as user actions, with general page and backend performance metrics.

Cookies are used to:

  • Monitor site performance
  • Analyze website usage
  • Track user behavior

The data stored in cookies is made up of random values, time stamps, and data that are required to correctly identify the applications in your monitored environment. The RUM JavaScript must be able to set and modify these cookies. This means that Dynatrace cookies don't support the HTTPOnly flag. Cookies must be included with each request so that user actions can be correlated with backend performance.

You can use the Secure cookie flag; however, this leads to loss of visibility into any unencrypted HTTP communication.

Dynatrace cookies

The following table provides an overview of cookie usage in Dynatrace. These are all first-party cookies.

Note that if you use Dynatrace to monitor your own customers' websites, you may reuse the cookie information detailed in the table below for your organization's own cookie policy.

New dtCookie format in Dynatrace version 1.215+

Starting with Dynatrace version 1.215, the dtCookie format changes as indicated in the table below. If the dtCookie is blocked or modified by an unsupported OneAgent to an old format, the correlation between requests and actions will not work.

Actions required:

  1. If you instrumented your app manually, update the RUM JavaScript to version 1.215+.
  2. Prepare your firewall and security appliance to allow the new format in case you apply filtering, which is a recommended practice.
  3. If you still use unsupported OneAgent version 1.167 or earlier for monitoring your apps for RUM, make sure you update your OneAgents at your earliest convenience. Otherwise, the cookie regenerated by OneAgent is detected as invalid.
Cookie Structure Expires Max size Purpose
dtCookie1

v1 session state: value$value|key1|value1|key2|value2|keyN|valueN
v3 session state: =3=key1=value1=key2=value2=keyN=valueN
v4 session state: v_4_key1_value1_key2_value2_keyN_valueN

Possible keys include:

  • srv
  • sn
  • mvisitor
  • msn
  • perc
  • ol
  • mul
  • app:<appID>

v1 example: 7$4D3133F359A76AB05AAF39691696858A|6553c6d885d99eec|1|b271251279634e2d|1
v2 example: =3=srv=7=sn=4D3133F359A76AB05AAF39691696858A
v3 example: v_4_srv_7_sn_4D3133F359A76AB05AAF39691696858A

session No set limitation but usually less than 100 B Tracks a visit across multiple requests.
dtLatC <numeric value> session 5 B Measures server latency for performance monitoring.
dtPC <serverID>$<randomValue>_<currentMillis>v<randomValue>e<eventCount> session 58 B Required to identify proper endpoints for beacon transmission; includes session ID for correlation.
dtSa2 <URL-encoded action name> session Max number of characters in the URL Intermediate store for page-spanning actions
dtValidationCookie The dTValidationCookieValue string. Deleted after a few milliseconds, no expiry date set. Length of dTValidationCookieValue string, that is 23 Used to determine the top-level domain.
rxVisitor <visitorID> permanent 45 B Visitor ID to correlate sessions
rxvt <timestamp>|<timestamp> session 27 B Session timeout
1

Dynatrace version 1.215+. For earlier versions, see dtCookie Dynatrace version 1.214 and earlier.

2

The dtSa cookie is used to save user action names, such as Click on Login, across different pages. This is required because page loads result in JavaScript code restart, so all contextual information must be stored in cookies.

Dynatrace cookies are essential for providing you with all the benefits of Real User Monitoring. If you provide your users with the option to decline the use of these cookies, Real User Monitoring won't work to its full potential.

To provide your end users with a cookie opt-out capability, Dynatrace must be configured appropriately. Usually Dynatrace creates tracking cookies automatically. When using cookie opt-in mode, Dynatrace RUM tracking is disabled by default and no cookies are created. When an end user accepts your cookie policy (opt-in mode), Dynatrace RUM is enabled by calling dtrum.enable() within the RUM JavaScript. Following this method invocation, Dynatrace tracking cookies are created and RUM is activated.

For details on configuring cookie opt-out mode, see Configure Real User Monitoring according to GDPR.

When a lot of cookies are in use, some browsers delete a few cookies at random. To avoid losing data from such deleted cookies, Dynatrace stores backups of all cookies. When Use persistent cookies for user tracking is enabled, this backup is stored in localstorage. Otherwise, it's stored in sessionstorage.

Persistent cookies

Dynatrace stores backups of the following cookies:

  • rxVisitor
  • rxvisitid
  • rxvt
  • rxec

The backup of dtCookie is always stored in sessionStorage and the backup of ruxitagentjs_<appid or empty>_Store is always stored in localstorage.

Dynatrace also uses localStorage to cache the last monitor beacon response, which contains the RUM JavaScript configuration.

Secure cookies

Dynatrace allows you to set the Secure cookie attribute for all cookies that are set by Dynatrace. By applying this attribute (flag) on the Set-Cookie header, you ensure that the browser sends these cookies only over secure connections.

Note that Dynatrace cookies don't support HTTPOnly. Cookies must be included with each request so that user actions can be correlated with backend performance. If, in such cases, you use the Secure cookie flag, the flag may lead to loss of visibility into any unencrypted HTTP communication.

Before enabling the Secure cookie flag, make sure the application is completely served over secure connections.

To set the Secure cookie flag

  1. In the Dynatrace menu, select Web.
  2. Select the application for which you want to set the Secure cookie flag.
  3. On the application overview page, select Browse () > Edit.
  4. From the application settings, go to Capturing > Advanced setup.
  5. Scroll to Cookie and header settings, and enable Use the Secure cookie attribute for cookies set by Dynatrace.
    Setting the Secure cookie flag

SameSite cookies

You can find a great explanation of the SameSite cookie attribute on the web.dev site.

To set the SameSite attribute

  1. In the Dynatrace menu, select Web.
  2. Select the application for which you want to set the SameSite attribute.
  3. On the application overview page, select Browse () > Edit.
  4. From the application settings, go to Capturing > Advanced setup.
  5. Scroll to Cookie and header settings and select the desired SameSite cookie attribute.

If your applicable privacy law requires you to reduce the lifetime of permanent cookies, you can use a custom configuration property to reduce the lifetime of our permanent rxVisitor cookie.

  1. In the Dynatrace menu, select Web.
  2. Select the application for which you want to set the cookie lifetime.
  3. On the application overview page, select Browse () > Edit.
  4. From the application settings, go to Capturing > Advanced setup.
  5. Scroll to JavaScript library.
  6. Under Custom configuration properties, add the rvcl=[<time-in-months>, 1-24] key-value pair to set your desired cookie lifetime value. Indicate the time in months (up to 24). For example, rvcl=12 is 12 months. If custom properties are already configured, append this setting after the | character.