What is the SERVERID cookie?
Maintains session persistence by routing a visitor's requests to the same backend server.
Table of Contents
About SERVERID
| Vendor | HAProxy Technologies |
|---|---|
| Category Category The functional category of the technology, such as Web Analytics or Social Media. Learn more | Site Infrastructure & Security |
| Consent Category Consent Category The consent category this cookie most commonly falls under across sites we scan, normalized into four standard categories. Learn more | Strictly Necessary |
| Prevalence | Very Common |
| Popularity Popularity Popularity is calculated from our dataset of 4.5B+ cookies analyzed across hundreds of millions of web pages. Learn more | Found on 13.6% of scanned pages |
| Expiration Type | Timestamp |
| Party Type Party Type Whether the cookie is first-party or third-party. Learn more | 3rd-Party |
| Risk Level Risk Level Rates how sensitive the data stored by this cookie is (High, Medium, or Low) based on data classification and distribution. Learn more | Low |
| Vendor Privacy Policy | https://www.haproxy.com/privacy-policy |
| Vendor Website | https://www.haproxy.com/ |
What is the purpose of SERVERID?
The SERVERID cookie is an infrastructure-level session affinity identifier generated by load balancers, most notably HAProxy. When a website or API utilizes a cluster of backend servers to manage traffic, the load balancer must ensure that all HTTP requests from a given user session are continuously routed to the same physical or virtual server to maintain session state. To achieve this, the load balancer injects the SERVERID cookie into the HTTP response, embedding a hashed identifier of the designated backend server. Subsequent requests from the browser include this cookie, allowing the load balancer to correctly route the traffic.
While this cookie can be set as a first-party cookie by a website's own infrastructure, it is frequently observed as a third-party cookie. This occurs when a website integrates external tracking services or vendor APIs, such as the Eyeota tracking pixel (ps.eyeota.net; Eyeota has been part of Dun & Bradstreet since 2021), that rely on HAProxy load balancers for their own endpoints. In such cases, the third-party endpoint issues the SERVERID cookie to maintain stability during its data collection process.
What are the Privacy Risks of SERVERID?
Risk Level: Low
The SERVERID cookie is a functional infrastructure cookie that solely contains a routing identifier pointing to a specific backend server. It does not contain personally identifiable information (PII), track behavioral data, or facilitate cross-site profiling. Although it is frequently delivered alongside third-party tracking pixels, the cookie itself is benign and serves only to ensure reliable server-side communication.
How to Remove SERVERID from a Website
The SERVERID cookie is dynamically generated by the load-balancing infrastructure of the server receiving the request. When this cookie is set by a third-party service (such as an Eyeota tracking pixel or external API), it cannot be disabled independently without breaking the vendor's service. To prevent this cookie from dropping, the website administrator must identify the initiating vendor and remove the associated third-party tag, script, or pixel from the website's source code or Tag Management System. If the cookie originates from the website's own first-party load balancer, the system administrator must reconfigure the load balancer (e.g., removing the cookie SERVERID insert directive in HAProxy), though doing so is not recommended as it will likely break session persistence for logged-in users.