Remember Me & Session Duration

Once a visitor verifies their age, you don't want them to see the popup again on every page. AgeVerify Shield handles this with sessions and "Remember Me".

How Sessions Work

After successful verification, a server-side session is created:

Setting	Default Value
Session duration	24 hours
Max attempts	5
Cooldown after block	30 minutes

A signed cookie (__av_session) is set as a fallback, with the same expiry.

Remember Me

Each rule can have a custom "Remember Me" duration:

Setting	Behavior
0 days	Always ask – no persistence between visits
1-365 days	Remember for this many days via localStorage
Default (24h)	Session-based – cleared when browser closes or after 24 hours

Client Storage

On the client side, verified state is stored in localStorage with an expiration timestamp. This means:

Clearing browser data resets the verification
Different browsers = separate verification needed
Incognito/private mode always shows verification

Security

Cookies are HMAC-SHA256 signed to prevent tampering
Sessions are validated server-side on each request
IP addresses are hashed, never stored in plain text
Cookie flags: HttpOnly, Secure (production), SameSite=Lax