What is the `authjs.csrf-token` cookie?no consent needed

Set by NextAuth.js (Auth.js) (The website (Auth.js)). Expires after Session.

Strictly necessary — it can load freely

Cookies essential to the service are exempt from consent under ePrivacy Art. 5(3) — but authjs.csrf-token must still be disclosed in your cookie policy.

Purpose

Protects Auth.js sign-in requests against cross-site request forgery.

Cookie details

Cookie name: authjs.csrf-token
Service: NextAuth.js (Auth.js)
Provider: The website (Auth.js)
Category: Strictly Necessary
Duration: Session
Consent: Not required

GDPR requirements

Strictly necessary cookies are essential for the website to function and cannot be switched off. They are set only in response to actions made by you — such as logging in or filling forms. No consent is required.

For authjs.csrf-token to be compliant, it must be:

May be set as soon as the visitor arrives — no consent needed
Still disclosed in your cookie policy, with what it does and why it is necessary
Not shown as a toggle in your consent banner

How to handle it

1
Let it load freely
No consent gate is needed for this cookie.
2
Disclose it
List it in your cookie policy as strictly necessary for NextAuth.js (Auth.js).
3
Keep it out of the toggles
Strictly necessary cookies shouldn't be switchable in your consent UI.