# OriginRequestCookieBehavior

Determines whether any cookies in viewer requests (and if so, which cookies) are included in requests that CloudFront sends to the origin.

- Source: [`aws-cloudfront/lib/origin-request-policy.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cloudfront/lib/origin-request-policy.ts#L153)
- Type last changed: v2.88.0 · 20 Jul 2023

## Example

```ts
// Creating a custom origin request policy for a Distribution -- all parameters optional
declare const bucketOrigin: origins.S3Origin;
const myOriginRequestPolicy = new cloudfront.OriginRequestPolicy(this, 'OriginRequestPolicy', {
  originRequestPolicyName: 'MyPolicy',
  comment: 'A default policy',
  cookieBehavior: cloudfront.OriginRequestCookieBehavior.none(),
  headerBehavior: cloudfront.OriginRequestHeaderBehavior.all('CloudFront-Is-Android-Viewer'),
  queryStringBehavior: cloudfront.OriginRequestQueryStringBehavior.allowList('username'),
});

new cloudfront.Distribution(this, 'myDistCustomPolicy', {
  defaultBehavior: {
    origin: bucketOrigin,
    originRequestPolicy: myOriginRequestPolicy,
  },
});
```

## Properties

- `behavior`: string — The behavior of cookies: allow all, none or an allow list.

- `cookies`: string[] — The cookies to allow, if the behavior is an allow list.

## Methods

- `all(): OriginRequestCookieBehavior // chainable` (static) — All cookies in viewer requests are included in requests that CloudFront sends to the origin.

- `allowList(...cookies: string[]): OriginRequestCookieBehavior // chainable` (static) — Only the provided `cookies` are included in requests that CloudFront sends to the origin.

- `denyList(...cookies: string[]): OriginRequestCookieBehavior // chainable` (static) — All cookies except the provided `cookies` are included in requests that CloudFront sends to the origin.

- `none(): OriginRequestCookieBehavior // chainable` (static) — Cookies in viewer requests are not included in requests that CloudFront sends to the origin.

  Any cookies that are listed in a CachePolicy are still included in origin requests.