Cookies

Aithne sets two cookies on .l42.eu:

• aithne_session — a short-lived token (15 minutes) that proves you are signed in. lucOS services verify this token locally, without contacting Aithne on every request.
• aithne_idp_session — a longer-lived token (3 days) used only by Aithne itself to issue fresh session tokens without requiring another passkey prompt. It is restricted to the /auth/remint path and is never sent to other services.

Both cookies are HttpOnly (not accessible to page JavaScript), Secure (sent only over HTTPS), and expire when the lifetime above is reached or when you sign out, whichever comes first.

Passkey data

When you register a passkey, your device generates a key pair. The private key stays on your device — Aithne never sees it. What Aithne stores:

• Your public key
• A credential identifier assigned by your device
• A sign count — a counter that increments with each authentication, used to detect cloned credentials
• An authenticator identifier (AAGUID) that indicates the make and model of your authenticator

Your biometric data (fingerprint, face, PIN) never leaves your device. Aithne has no access to it.

Sessions and revocation

When you sign out, your IdP session is revoked and both cookies are cleared. Active 15-minute session tokens issued before sign-out may remain valid until they expire — this is by design (tokens are verified locally, without a round trip to Aithne).

If a passkey is revoked by an administrator, it can no longer be used to authenticate. Any existing sessions continue until they expire.

Data deletion

To request deletion of your account data, email data.privacy@l42.eu.

← Home