Cookies
This site sets only cookies that are strictly necessary to provide the service you have requested. Such cookies are exempt from the consent requirement under § 25(2) Nr. 2 TDDDG. We set no analytics, advertising or tracking cookies, so no consent banner is required.
Cookies this site sets
| Name | Purpose | Lifetime | Who it affects |
|---|---|---|---|
drawbridge_session |
Signed, HTTP-only participant cookie holding a random identifier and nothing else. Which version of the story you were given, how far you had read and whether you had submitted are held on our server against that identifier. | 8 hours | participants |
drawbridge_csrf |
Protects the participant forms against cross-site request forgery (signed, HTTP-only). Separate from the cookie above so the deletion form still works later, when there is no pass left to carry it. | 8 hours | participants |
drawbridge_admin |
Keeps educators and administrators signed in (signed, HTTP-only). | 6 hours (educators) / 3 hours (administrators) | backoffice |
bo_csrf |
Protects backoffice forms against cross-site request forgery (signed, HTTP-only). | 1 hour | backoffice |
bo_flash |
Carries a one-off status message between two backoffice pages. | 10 seconds | backoffice |
db_pending_totp / drawbridge_pending2fa |
Carries the intermediate step of two-factor sign-in: the pending-login marker (5 minutes) and, while you are enrolling, the not-yet-confirmed TOTP secret (15 minutes). | 5-15 minutes | backoffice |
passkey_challenge |
Set only while you add a passkey or sign in with one: a signed, HTTP-only one-time challenge for your device to sign. Deleted as soon as it has been used. | 5 minutes | backoffice |
All cookies are set by this site itself (first-party). There are no third-party cookies.
You can block cookies in your browser settings; since the cookies listed here are required to run the service, the application will then no longer work correctly.