# V14.7.7 Upgrade- Session Fixation flaws related to user and anonymous ID cookies

**URL:** <https://community.bloomreach.com/t/v14-7-7-upgrade-session-fixation-flaws-related-to-user-and-anonymous-id-cookies/3241>\
**Category:** Experience Manager (PaaS/OnPrem)\
**Created:** [June 21, 2022, 9:55am UTC](https://community.bloomreach.com/t/v14-7-7-upgrade-session-fixation-flaws-related-to-user-and-anonymous-id-cookies/3241 "2022-06-21T09:55:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yeshwanth\_Lagala](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/yeshwanth_lagala/32/777_2.png) [@Yeshwanth\_Lagala](https://community.bloomreach.com/u/Yeshwanth_Lagala)\
**Post date:** [June 21, 2022, 9:55am UTC](https://community.bloomreach.com/t/v14-7-7-upgrade-session-fixation-flaws-related-to-user-and-anonymous-id-cookies/3241/1 "2022-06-21T09:55:39Z")

</div>

Hi Team,

Post v14.7.7 CMS upgrade, we have performed security scans and found the flaws related to session fixation. Could you please let us know if we can delete these cookies at apache level ?

**cookie name:** ajs\_anonymous\_id and ajs\_user\_id

Looks like above mentioned cookies are introduced in Bloomreach v14.7.6/14.7.7

Thanks,  
Yeshwanth.

---

<div class="post-metadata">

**Author:** ![machak](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/machak/32/1298_2.png) [@machak](https://community.bloomreach.com/u/machak)\
**Post date:** [June 21, 2022, 10:58am UTC](https://community.bloomreach.com/t/v14-7-7-upgrade-session-fixation-flaws-related-to-user-and-anonymous-id-cookies/3241/2 "2022-06-21T10:58:49Z")

</div>

I don’t think those are set by us…  
you can check:

> **[All You Need to Know About Cookies | Cookiepedia](https://cookiepedia.co.uk/)**
>
> Cookiepedia is all about cookies and online tracking. We categorise cookies and host domains to enable people to make informed online privacy choices.

---

<div class="post-metadata">

**Author:** ![Yeshwanth\_Lagala](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/yeshwanth_lagala/32/777_2.png) [@Yeshwanth\_Lagala](https://community.bloomreach.com/u/Yeshwanth_Lagala)\
**Post date:** [June 21, 2022, 12:03pm UTC](https://community.bloomreach.com/t/v14-7-7-upgrade-session-fixation-flaws-related-to-user-and-anonymous-id-cookies/3241/3 "2022-06-21T12:03:33Z")

</div>

@machak

When we tried running maven archetype project (v14.7.7) developer edition. I can see these cookies. refer snapshot.

 ![image](https://canada1.discourse-cdn.com/flex027/uploads/bloomreach1/original/2X/2/25110c3e5cce1b29a73cc1877e9e4141201744e2.png)

Thanks,  
Yeshwanth.