# Third-party cookies and embedded sessions

*Tableau Server Administrator Study Guide · Troubleshooting · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-server-administrator/troubleshooting/third-party-cookies-and-embedded-sessions*

Why Tableau Server sign-in depends on a browser session cookie, when that cookie counts as first-party or third-party, what a redeemed trusted ticket leaves behind, and how to locate an embedded sign-in failure before changing settings.

- Certification: Salesforce Tableau Server Administrator
- Exam section: Troubleshooting
- Study guide: https://www.certifyforce.com/study-guide/tableau-server-administrator

**Official exam objective:**

> 4.1 Understand requirements of third-party cookies in a browser

## What the exam expects

- Explain how Tableau Server keeps a signed-in browser user authenticated, and what happens when the browser refuses to store that cookie.
- Classify the Tableau session cookie as first-party or third-party from the domain in the browser's address bar.
- State the third-party cookie requirement for embedded views, trusted authentication and connected apps.
- Describe the sign-in state a browser is in after Tableau Server redeems a trusted ticket.
- Tell a ticket-issuance failure apart from a browser cookie failure when an embedded sign-in breaks.

Key terms:
- **Session cookie:** the cookie stored in the browser at sign-in that tells Tableau Server the user is already authenticated.
- **First-party cookie:** a cookie set for the same domain or sub-domain as the browser's address bar.
- **Third-party cookie:** a cookie set for a domain different from the one in the address bar, as happens inside an embedded view.
- **Trusted ticket:** a short-lived string a trusted web server obtains from Tableau Server so a portal user skips a second sign-in.
- **Connected app:** a trust relationship (direct trust or OAuth 2.0 trust) that authenticates embedded users with a JSON Web Token.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| What keeps a user signed in | A session cookie stored in the local browser at sign-in | [Cookie Restriction Error](https://help.tableau.com/current/server/en-us/trusted_auth_trouble_cookie.htm) |
| Browser blocks first-party cookies | The user cannot sign in to Tableau Server | [Cookie Restriction Error](https://help.tableau.com/current/server/en-us/trusted_auth_trouble_cookie.htm) |
| Embedded or trusted sign-in | Cookie domain differs from the address bar, so it is third-party | [Cookie Restriction Error](https://help.tableau.com/current/server/en-us/trusted_auth_trouble_cookie.htm) |
| Ticket redemption | Creates a session, logs the user in, removes the ticket from the URL | [Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth.htm) |
| `wgserver.unrestricted_ticket` | Default `false`: trusted-ticket users reach views only | [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) |
| Connected apps | Introduced in 2021.4; browsers must still allow third-party cookies | [Authentication and Embedding](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_auth.html) |
| `wgserver.saml.iframed_idp.enabled` | Default `false`: embedded SAML sign-in opens in a pop-up | [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) |
| Idle timeout | `wgserver.session.idle_limit`, default 240 minutes | [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) |
| Ticket value `-1` | Server could not issue the ticket; reason in the vizqlserver logs | [Ticket Value of -1](https://help.tableau.com/current/server/en-us/trusted_auth_trouble_1return.htm) |

## Check yourself

- Why can a second person at a shared browser still reach an embedded view after the first person leaves the host application?
- By default, where does a SAML user's identity-provider sign-in form open after they select the sign-in button on an embedded view?
- When you need more trusted-authentication detail in the logs, which key do you change and what must follow?
- Which Tableau release introduced connected apps for embedded content, and what do they use to authenticate users?

## Sources

- [Cookie Restriction Error](https://help.tableau.com/current/server/en-us/trusted_auth_trouble_cookie.htm)
- [Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth.htm)
- [Troubleshoot Trusted Authentication](https://help.tableau.com/current/server/en-us/trusted_auth_trouble.htm)
- [Ticket Value of -1 Returned from Tableau Server](https://help.tableau.com/current/server/en-us/trusted_auth_trouble_1return.htm)
- [Authentication and Embedding](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_auth.html)
- [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm)
- [Security Hardening Checklist](https://help.tableau.com/current/server/en-us/security_harden.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 2 linked practice questions, and unlimited timed mock exams are included with the Tableau Server Administrator pack (USD $19): https://www.certifyforce.com/practice-exams