DOCS: Document cookie usage in Etherpad - Waiting on Final Edits

Overview

It’s important to the Users and the host of the Etherpad instance to know what cookies are used in Etherpad and what is their purpose.

List of known cookies issued by Ethepad

name	sample value	domain	path	expires/max-age	http	secure	usage
express_sid	s%3A7yCNjRmTW8ylGQ53I2IhOwYF9…	example.org	/	1969-12-31T23:59:59.000Z	true	true	Session ID of the Express web framework. When Etherpad is behind a reverse proxy, and an administrator wants to use session stickiness, he may use this cookie. If you are behind a reverse proxy, please remember to set trustProxy: true in settings.json
io	uUrtV8P-cJF0IVDOAAAV	example.org	/	1969-12-31T23:59:59.000Z	true	false	No longer used since Etherpad 1.8, see a51684b0227942b87c4742fbbdc3934c2a4d7018
language	en	example.org	/	1969-12-31T23:59:59.000Z	false	true	The language of the UI (e.g.: en-GB, it)
prefs	%7B%22epThemesExtTheme%22…	example.org	/p	3000-02-25T13:17:08.000Z	false	true	client-side preferences (e.g.: font family, chat always visible, show authorship colors, …)
token	t.tFzkihhhBf4xKEpCK3PU	example.org	/	2019-04-26T13:17:07.000Z	false	true	A random token representing the author, of the form t.randomstring_of_lenght_20. The random string is generated by the client, at (pad.js#L55-L66). This cookie is always set by the client (at pad.js#L153-L158) without any solicitation from the server. It is used for all the pads accessed via the web UI (not used for the HTTP API). On the server side, its value is accessed at SecurityManager.js#L33.
sessionID	s.1c70968b333b25476a2c7bdd0e0bed17	example.org	/	2019-04-26T13:17:07.000Z	?	?	Sessions can be created between a group and an author. This allows an author to access more than one group. The sessionID will be set as a cookie to the client and is valid until a certain date. The session cookie can also contain multiple comma-separated sessionIDs, allowing a user to edit pads in different groups at the same time. More info - https://github.com/ether/etherpad-lite/blob/develop/doc/api/http_api.md#session

TODO

• Extend the cookie list above
• Add usage clarifications to every cookie

[muxator]

replace the domain myinstance.com with example.org

Done. Thanks for the hint @ukcb.

@tiblu, could you make a PR for the documentation, so we can work on that one?

[ukcb]

Small hint: If you are already there, you could also replace the domain myinstance.com with example.org. This domain is for use in illustrative examples in documents. You may use this domain in literature without prior coordination or asking for permission.