What is the AWSALBCORS cookie?
AWSALBCORS is a cookie automatically generated by Amazon Web Services' Application Load Balancer (ALB) service, used by many websites and web applications hosted on AWS infrastructure with load balancing across multiple servers.
The cookie appears when a site hosted on AWS uses an Application Load Balancer configured with sticky sessions, and the request originates in a cross-origin context (for example, resources loaded from another domain or subdomain). It is not set directly by the site's developers but by the underlying AWS infrastructure the application runs on.
What data it stores
The cookie stores an identifier generated by the ALB, used to route the same visitor's subsequent requests to the server instance that handled the initial request. The value is an internally encoded/encrypted string produced by AWS, without human-readable user information, and does not contain directly exploitable personal data.
It is sent with every HTTP request to the relevant domain, directly to the site's own AWS infrastructure (not to third-party Amazon servers for advertising or analytics). The typical expiry is 7 days, though this can be configured differently by the infrastructure administrator.
What it is used for
The purpose of AWSALBCORS is strictly technical: it maintains session continuity for a visitor when a site runs behind an AWS Application Load Balancer with multiple backend servers. Without this cookie, cross-origin requests from the same user could be routed to different servers, potentially breaking the session or features that depend on state kept on a specific server.
It is the CORS-friendly counterpart of the AWSALB cookie, used specifically for requests involving cross-origin resource sharing, such as API calls to a different subdomain of the same site.
Does it require consent?
AWSALBCORS is classified as strictly necessary (required for the technical functioning of the site), since it directly supports correct page delivery and session continuity on load-balanced infrastructure.
- Under GDPR and the ePrivacy Directive, strictly necessary cookies do not require prior visitor consent.
- Site administrators must still disclose it in their cookie policy, naming the provider (Amazon Web Services), its purpose, and duration.
- It should not be placed in the "statistics" or "marketing" category of a consent banner.
How to block or delete AWSALBCORS
A visitor can delete or block AWSALBCORS through browser settings (Chrome, Firefox, Edge, Safari — per-site cookie management), but this may affect session stability or features relying on communication with the load balancer, especially on high-traffic sites.
Since it is strictly necessary, site administrators should not block it via the consent banner — a CMP such as CookieFix can be configured to automatically classify it as necessary and let it load without waiting for consent, unlike statistics or marketing cookies, which it blocks by default until acceptance.
Frequently asked questions
No, it's a technical cookie used exclusively to correctly route requests between servers behind an AWS Application Load Balancer, not for tracking or advertising.
No, as a strictly necessary cookie for the site's technical operation, it doesn't require consent under GDPR/ePrivacy, but it must be disclosed in the cookie policy.
The browser will receive a new one on the next request; in the short term this may cause session issues or redirection to a different server in the load-balancing pool.
AWSALB manages session stickiness for standard requests, while AWSALBCORS does the same for cross-origin (CORS) requests, carrying the attributes needed to be sent in such contexts.