Hi Espen,

These will respect the httpCookies configuration in you web.config, to make them secure you should set requireSSL to true.

EPi:StateMarker is a visitor group state marker (not sure on the specifics) and EPi:ViewedPages is used in tracking pages the user has viewed (again for visitor group personalization, specifically the "Visited Page" criterion).

And adding for future reference (in Episerver documentation):

• CMS cookies
• Forms
• Tracking
• GDPR posting by Episerver(list few cookies)

Also Mark Everard has collected a list of Episerver cookies to his github.

@Antti: Thanks for sharing those—some good resources.

I did already check the cookie documentation, however, it seems to be out of date given that the EPi:StateMarker cookie was introduced in EPiServer.Framework.AspNet 11.9.0. Looks like it may be used to track the start of a session.

It's the same case with the EPi:ViewedPages cookie, from EPiServer.CMS.AspNet 11.9.0 onwards this cookie is set depending on your state storage preferences, before this Episerver visitor groups always required session states.

As per the documentation from 11.9.0 you can also configure your own custom state storage: https://world.episerver.com/documentation/developer-guides/CMS/personalization/session-handling-in-visitor-group-criteria/

Long story short, I think the documentation needs updating.

Thank you both. Adding the httpCookies config did the trick.

And yes, there is definitely a lack of documentation, at least on the StateMarker cookie. That explains why my Google searches failed me.

Is it possible to disable the EPi:StateMarker cookie?

To answer my own question: 

Add this to global.asax.cs

protected void Application_EndRequest()


        }

The colon character ':' is invalid in a cookie name. This breaks an ApiController implementation we have that tries to get a cookie value using: 

Request.Headers.GetCookies(name).FirstOrDefault()

The ':' character in "EPi:StateMarker" prevents successful parsing of the cookie header value and so no cookies are returned.

A workaround is to use: 

HttpContext.Current.Request.Cookies.Get(name)

I suggest that Episerver change the "EPi:" cookie names so that they no longer use invalid characters.

A <cookie-name> can be any US-ASCII characters, except control characters, spaces, or tabs. It also must not contain a separator character like the following: ( ) < > @ , ; : \ " /  [ ] ? = { }.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie