Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
INGRESSCOOKIE is a load-balancing cookie, not a tracking cookie. If you’ve found it in a cookie scan, the site you’re looking at almost certainly runs on Kubernetes behind the Ingress NGINX controller, with “sticky sessions” switched on so each visitor keeps reaching the same backend server.
What Is the INGRESSCOOKIE Cookie?
The Ingress NGINX controller routes web traffic into a Kubernetes cluster. When an operator adds the annotation nginx.ingress.kubernetes.io/affinity: cookie, the controller turns on cookie-based session affinity. The Ingress NGINX annotations reference says that unless a different name is set with session-cookie-name, “the default is to create a cookie named ‘INGRESSCOOKIE’.” Cookie is the only affinity type NGINX supports.
According to the project’s sticky sessions example, the cookie “contains a randomly generated key corresponding to the upstream used for that request,” chosen by consistent hashing. It identifies a server, not a person. If the browser sends a value that doesn’t match any upstream, NGINX picks one and issues a new cookie.
Why Sites Use Sticky Sessions
Some applications keep session state, such as a login or a shopping cart, in the memory of a single server. If the load balancer sent the next request to a different pod, that state would be missing. INGRESSCOOKIE stops that from happening. It works much like the language-level session cookies it often sits beside, such as PHPSESSID or Java’s JSESSIONID, which we walk through in our session cookie DevTools guide. Cloud load balancers do the same job with their own cookies, for example AWS’s AWSALBCORS.
How Long Does INGRESSCOOKIE Last?
That’s up to the site operator. The documented annotations include:
session-cookie-max-age: seconds until the cookie expires, written as aMax-Agedirective.session-cookie-expires: the legacy equivalent, written as anExpiresdate for older browsers.session-cookie-path,session-cookie-domain,session-cookie-samesiteandsession-cookie-secure: the usual cookie attributes.session-cookie-change-on-failure: whentrue, a failed request moves the visitor to a different upstream. The default isfalse.affinity-mode:balanced(the default) redistributes some sessions when the deployment scales up, whilepersistentgives maximum stickiness.
The docs don’t list a default lifetime. If an operator sets no expiry, browsers treat a cookie like this as a session cookie that ends when the browser closes. The project’s own example sets both values to 172800 seconds (48 hours), and its sample response shows the cookie flagged HttpOnly with Path=/. Scanners will show whatever each site has configured, so check your own response headers.
Does INGRESSCOOKIE Need Consent?
EU and UK
Usually not. The ePrivacy rules exempt storage that’s strictly necessary to deliver a service the user asked for, and European regulators have long named load-balancing cookies as an example of that. INGRESSCOOKIE only routes requests and doesn’t carry a user identifier, so it normally belongs in the strictly necessary category. Keep its lifetime short and limited to what the session needs. A stickiness cookie set to last months gets harder to justify as essential.
US states
It isn’t used for advertising or shared with third parties, so it isn’t a “sale” or “share” under CCPA-style laws. List it in your cookie policy as a functional or necessary cookie so the disclosure is complete.
How to Block or Delete INGRESSCOOKIE
- Visitors: you can delete it, but the site may log you out or lose your cart if its app relies on server memory. Our guide to deleting cookies without logging out shows how to remove one site’s cookies at a time.
- Site owners: rename it with
session-cookie-nameif you’d rather not reveal your stack, set a shortmax-age, and addSecureand aSameSitevalue. - Better still: make your app stateless, with sessions stored in a shared cache or database, and you may not need sticky sessions at all.
A Note on Ingress NGINX’s Retirement
Kubernetes has announced the retirement of Ingress NGINX. Best-effort maintenance ran until March 2026, with no further releases or security fixes after that, though existing deployments keep working. If your team migrates to another controller or the Gateway API, the sticky cookie’s name and attributes will probably change, so update your cookie inventory when you switch.
Managing Infrastructure Cookies With Captain Compliance
Captain Compliance’s cookie scanner detects INGRESSCOOKIE and other infrastructure cookies and files them as strictly necessary, so they aren’t blocked by your consent banner while marketing tags wait for opt-in. Our overview of cookie consent requirements covers the rules by region.
FAQ
Does INGRESSCOOKIE track me across websites?
No. It’s a first-party cookie set by the site’s own load balancer, and its value points to a backend server rather than to you.
Why does the value look like a long random string?
It’s a randomly generated key that NGINX maps to one upstream server using consistent hashing.
Can a site call this cookie something else?
Yes. INGRESSCOOKIE is only the default. Operators often rename it with the session-cookie-name annotation, so the same cookie can appear under another name.
The INGRESSCOOKIE cookie is part of a site’s plumbing. Treat it as strictly necessary, keep its lifetime short, and record it in your cookie policy.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
