Okta

Overview

Okta is the leading cloud-native enterprise identity platform, providing single sign-on, multi-factor authentication, lifecycle management, and API access management for thousands of organizations worldwide. It operates as a standalone identity provider (IdP) that federates authentication across cloud and on-premises applications.

What This Script Does

Okta's browser-side behavior centers on authentication flows, session management, and the Okta Sign-In Widget — a JavaScript SDK that renders login forms and handles credential submission client-side before redirecting to the target application.

Session Cookies

• sid — First-party session cookie scoped to the Okta domain (e.g., company.okta.com). Stores the authenticated session identifier. Persists for the duration of the SSO session (typically 8–24 hours depending on policy). HTTP-only, Secure.
• oktaStateToken — Short-lived token cookie used during the authentication flow to maintain state between steps (username entry, MFA challenge, etc.). Expires on flow completion.
• DT — Device trust cookie used by Okta FastPass and device assurance policies to identify recognized devices. Persists for up to 1 year.

Script Files Loaded

• okta-sign-in.min.js — The Okta Sign-In Widget, loaded from the organization's Okta subdomain or from a CDN path under global.oktacdn.com. Handles credential entry, MFA prompts, and social login buttons.
• Auth SDK may also load polyfills and locale bundles from global.oktacdn.com.

Domains Contacted

• {tenant}.okta.com or {tenant}.okta-emea.com — Primary IdP domain handling authentication API calls (/api/v1/authn, /oauth2/v1/authorize, /oauth2/v1/token).
• global.oktacdn.com — CDN delivering the Sign-In Widget JavaScript and CSS.
• login.okta.com — Used for identity-first flows and Okta's hosted sign-in pages.

Data Collected Per Interaction

• Username and password (submitted over TLS to Okta's authentication API)
• MFA responses (TOTP codes, push notification confirmations, WebAuthn assertions)
• IP address and user-agent (captured server-side for login risk assessment)
• Device fingerprint (for Okta ThreatInsight and device trust policies)
• Session state tokens passed between authentication steps

SSO and OIDC/SAML Flows Okta handles the full SAML 2.0 and OpenID Connect (OIDC) flow. For SAML, it issues signed XML assertions. For OIDC, it returns authorization codes exchanged for access and ID tokens. Redirects are managed via browser-based HTTP 302 redirects to the callback URL registered on the application.

Lifecycle Management When embedded on IT portals or admin pages, Okta scripts may also render the Okta End-User Dashboard for app launching, password management, and device enrollment.

Consent & Compliance

Consent category: Essential / Functional

• GDPR/ePrivacy: Exempt from consent. Authentication scripts are strictly necessary for the service the user has explicitly requested (logging in). The cookies set (sid, DT) are required for maintaining the authenticated session and cannot be replaced with less privacy-invasive alternatives. Under ePrivacy Article 5(3), cookies that are strictly necessary for a service explicitly requested by the user are exempt.
• CCPA/CPRA: Authentication processing is exempt from CCPA's sale/sharing restrictions as it constitutes service delivery.
• Data transfers: Okta is a US company. Okta participates in the EU-US Data Privacy Framework (DPF), providing an adequacy mechanism for EU-to-US data transfers. Standard Contractual Clauses (SCCs) are also available.
• No IAB TCF purposes apply — Okta does not participate in the IAB TCF ecosystem.

Should You Block This Without Consent?

No. Okta handles authentication and access control. Blocking its scripts and cookies would prevent users from logging in entirely. Authentication flows are strictly necessary and are exempt from consent requirements under both GDPR/ePrivacy and CCPA.