Cookies and browser storage
Updated: 21 October 2026.
This public website
The public pages at imdugud.uj.edu.pl set no cookies and do not write to local storage, session storage or IndexedDB. They contain no analytics, advertising, third-party content embeds or tracking pixels. Fonts and images are served from this website. No optional-cookie consent is requested because no optional cookies are used.
Language is selected by a normal link: English at /, Polish at /pl/, and Ukrainian at /uk/. The /ua/ address redirects to Ukrainian. Your choice is part of the page address; it is not saved as a cookie or written to your account. Public content works without JavaScript. Session-aware navigation uses a small locally hosted script. Your browser may cache public files as part of normal HTTP operation.
When you open another service
The following services are separate from this public website. Their authentication and security cookies become relevant only when you visit them:
- id.imdugud.uj.edu.pl — Keycloak. Session and sign-in state, including cookies such as
AUTH_SESSION_ID,KC_RESTART,KEYCLOAK_SESSIONandKEYCLOAK_IDENTITY.KEYCLOAK_LOCALEremembers a language for the sign-in interface. Changing the sign-in language does not change the language saved in your user profile. - git.imdugud.uj.edu.pl — Forgejo. Session, CSRF protection and interface preferences, including cookies such as
i_like_giteaandlang. Uploaded or generated avatars are local; Gravatar and federated avatar lookup are disabled. - Registration protection. Self-hosted Cap checks a challenge during registration. Its scripts and WebAssembly files are served under the identity domain, rather than fetched by your browser from an external CAPTCHA provider.
Cookie names and lifetimes depend on the action and session settings. Session cookies expire with the session; preference cookies may persist until expiry or deletion. Your browser’s storage inspector shows the exact cookies and expiry times for each service. These services are not embedded into the public page.
Keycloak storage in more detail
On the registration page, inspection found AUTH_SESSION_ID (session cookie, Secure and HttpOnly) and KC_AUTH_SESSION_HASH (short-lived sign-in synchronisation cookie, readable by Keycloak's browser code). Other flows can also use KC_RESTART for restoring sign-in, KEYCLOAK_IDENTITY for SSO identity, KEYCLOAK_SESSION for session synchronisation, and KEYCLOAK_LOCALE for the chosen sign-in language. These names describe authentication and requested preferences, not advertising identifiers. Exact expiry depends on the flow. SSO currently times out after 30 minutes of inactivity or 10 hours in total; remember-me is disabled. Account records outlive these cookies.
The registration page did not write to localStorage or sessionStorage during inspection. The account console's authentication adapter can temporarily store OIDC state, nonce and PKCE verifier data in browser storage while redirecting to sign-in; these protect the login exchange and are not analytics. Cap performs a local computational challenge; its scripts contain no cookie, localStorage or sessionStorage persistence. Server-side challenge and token state is separate from browser cookies.
Essential storage used to provide a sign-in or registration you request is distinguished from optional tracking. This assessment follows the necessary-service exception in Article 399 of the Polish Electronic Communications Law. No optional analytics or advertising storage is enabled. Selecting a sign-in language does not alter the saved profile language. See account privacy information.
Your controls
You can block or delete cookies and clear stored site data using your browser’s privacy settings. Clear data separately for the public, identity and Git domains. Blocking essential authentication cookies can prevent sign-in, while the public website remains readable.
If optional tracking is introduced later, the notice and controls must be updated before it is activated. Optional technologies must not load before the necessary consent, and rejecting them must remain possible. The current page does not offer an “accept all” button or imply consent from continued browsing.
A short-lived imdugud_logout cookie (Secure, HttpOnly, up to 120 seconds, scoped to / across Imdugud subdomains) binds the final Git sign-out cleanup to the browser that started Keycloak logout. It is cleared when the cleanup page is opened. Opening the sign-in link copies the selected page language into KEYCLOAK_LOCALE on the identity domain only; it is not written to the profile.
Sign-in status in navigation
A small local script checks whether an existing Keycloak session is active, using a hidden first-party frame on the identity domain. If there is no identity cookie, the proxy immediately reports that you are signed out without opening a Keycloak authentication session or setting a new authentication cookie. When a cookie already exists, Keycloak validates the existing session directly, without starting another login flow. The public page receives only sign-in and administrator-status flags plus a one-time random value held in memory, not access tokens, your name or your email address. No result is saved in localStorage, sessionStorage or a public-domain cookie. The check repeats when returning to the page. Without JavaScript, or if the check fails, the normal Sign in link remains available.