[Update] February 21, 2024
Safety is foundational to everything that we do and this includes ensuring the safety and security of your Roblox account. That’s why we are excited to introduce Account Session Protection, a new feature that will bolster the security of your Roblox accounts.
If you use cookies to develop third party applications for Roblox such as developer automation workflow tools or browser extensions, you may need to opt-out of Account Session Protection in order to preserve your functionality in the short-term (more detail below).
The Problem: Cookie Theft
Accounts can fall victim to compromise as a result of the theft of the “ROBLOSECURITY” cookie. The cookie should never be shared with anyone, as attackers who can access your “ROBLOSECURITY” cookie can potentially gain access to your account without a password and bypassing two step verification checks.
Cookies can be stolen without a user’s permission or even notification through various means, including phishing and browser extensions.
The Solution: Account Session Protection
Account Session Protection is designed to help prevent cookie theft by associating your account’s cookie to your device. With this feature enabled, even if someone has your “ROBLOSECURITY” cookie, they will not be able to access your account elsewhere using that cookie. Starting January 15th, 2024, everyone will have this enabled on selected API endpoints.
How May This Impact You?
While the benefits of Account Session Protection are significant, it may disrupt current developer automation workflows*:
- If you are a Roblox developer that uses cookies in your workflows, you may need to opt out of the new Account Session Protection feature to maintain your workflows. Please pay attention to the list of APIs that will be impacted, and the migration timelines listed below. Reliance on session cookies for automated workflows will not be supported long-term.
- If you develop browser extensions for the Roblox ecosystem, this may impact your users. Please pay attention to the list of APIs that will be impacted.
*Note: API Keys and OAUTH2 tokens created through Open Cloud will be unaffected. Open Cloud authentication is designed to be shared between applications securely.
How Do I Opt Out?
- If you have determined that you need access to some of the endpoints that will not be supported via Open Cloud, we will allow you to opt out of this protection via Creator Hub: Settings → Advanced.
- If you develop browser extensions, please do not recommend that your users disable this protection. Comment below with your use cases, so we can figure out how to best support you. By asking your users to opt out, please be aware you’re putting your user’s account at greater risk. We do not want to put you in a situation where you have to put your users at risk.
Detailed List of Impacted APIs and Rollout Timeline
We are committed to supporting developers with the highest level of security and least amount of disruption. To make sure you can transition smoothly, we are taking two steps:
- Step 1: We are starting enforcement on a selected set of API endpoints that have the highest security risks. Developers should not expect to access these endpoints via API in the future.
- Step 2: Other API endpoints will be unaffected and we are soliciting feedback to inform a gradual roll out of Account Session Protection. We’ll provide a more detailed timeline after gathering feedback from the community.
On January 15th 2024 By the end of June 2024, we will enforce Account Session Protection on the following Roblox domains (Updated on February 21, 2024):
- Why: We do not want third party browser extensions that users install to take sensitive actions that may pose a huge security risk such as managing credentials, creating new accounts, or modifying two step verification settings.
- We will not be enforcing the new policy on this entire domain, until we have Open Cloud replacements available for endpoints which you may need access to (for example: Roblox Badges), but we do want to lock down endpoints which could be used to promote account theft, or gain access to personal information. For this domain, we will be locking down all the following endpoints:
- GET/POST v1/birthdate
- GET/POST v1/gender
- GET/POST v1/phone
- POST v1/phone/delete
- POST v1/phone/resend
- POST v1/phone/verify
- POST/DELETE v1/star-code-affiliates
- POST v1/email/verify
- Why: We do not believe browser extensions should be managing personal information on behalf of their users, and we do not plan to provide Open Cloud alternatives for these endpoints.
- Why: We do not believe that accepting, countering or declining trades on behalf of users, are things that need to be automated. If you have legitimate use cases for these endpoints, please provide us your use cases in the comments (or DM), so we can look into supporting your use case.
- For this domain, we will be locking down all the following endpoints:
- POST v1/trades/{tradeId}/accept
- POST v1/trades/{tradeId}/counter
- POST v1/trades/{tradeId}/decline
- POST v1/trades/expire-outdated
- POST v1/trades/send
- Why: We do not believe that third party applications should manage payments on behalf of a Roblox user. If you have legitimate user cases for these endpoints, please provide us your use cases in the comments (or DM), so we can look into supporting your use case.
What about the rest of APIs?
We are still formulating plans on the following API endpoints and would love to get your feedback. Please fill out this form with your usage of the following APIs so we can plan to support development workflows via Open Cloud.
We will continue to iterate on Account Session Protection going forward to make Roblox a more safe and secure place for our community.
Thank you!
