---
title: "Breaking: #94243 - Send user session cookies as hash-signed JWT"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:breaking-94243-1664786038"
source: "Changelog/12.0/Breaking-94243-SendUserSessionCookiesAsHash-signedJWT.rst"
modified: "2026-09-15T10:46:36+00:00"
---

# Breaking: #94243 - Send user session cookies as hash-signed JWT

See [forge#94243](https://forge.typo3.org/issues/94243)

## Description

[JSON Web Tokens (JWT)](https://jwt.io/) are used to transport user session
identifiers in `be_typo_user` and `fe_typo_user` cookies. Using JWT's `HS256`
(HMAC signed based on SHA256) allows to determine whether a session cookie is
valid before comparing with server-side stored session data. This enhances the
overall performance a bit, since sessions cookies would be checked for every
request to TYPO3's backend and frontend.

JWT handling in PHP is provided by 3rd party package
[firebase/php-jwt](https://packagist.org/packages/firebase/php-jwt).

## Impact

Session cookies `be_typo_user` and `fe_typo_user` can be pre-validated without
querying the database, which can filter invalid requests and might reduce the
enhances the overall performance a bit.

As a consequence session tokens are not sent "as is" anymore, but are
wrapped in a corresponding JWT message, which contains the following payload:

-   `identifier` reflects the actual session identifier
-   `time` reflects the time of creating the cookie (RFC 3339 format)

## Affected installations

All instances using TYPO3 v12 and having custom implementations handling `be_typo_user`
and `fe_typo_user` cookie values.

## Migration

Custom implementations handling `be_typo_user` or `fe_typo_user` cookies,
have to use the introduced method `\TYPO3\CMS\Core\Session\UserSession::getJwt()`
instead of existing `\TYPO3\CMS\Core\Session\UserSession::getIdentifier()`.