Session Isolation is ContextFort’s core security feature that prevents agents from accessing your personal accounts. When an agent enters a website, ContextFort automatically swaps your human cookies with agent-specific cookies, ensuring complete session separation.
Critical Security Feature: Without session isolation, agents could access your Gmail, bank accounts, or any logged-in service.
Why capture subdomain cookies?
Many services use multiple subdomains (e.g., www.example.com, api.example.com, auth.example.com). All must be captured for complete session isolation.
function showLoginRequiredNotification(domain, phase = 1) { const notification = document.createElement('div'); notification.id = 'contextfort-login-notification'; notification.style.cssText = ` position: fixed; bottom: 20px; right: 20px; min-width: 360px; background: #1a1a1a; border-radius: 12px; padding: 20px; z-index: 2147483647; `; if (phase === 1) { // Phase 1: Initial prompt message.innerHTML = ` No saved agent session for <strong>${domain}</strong><br><br> Your session has been cleared. You need to login manually for the agent to use this site. `; // Show "Ok, I'll log in" button } else { // Phase 2: After user acknowledges message.innerHTML = ` Please login, then click "I've Logged In".<br><br> Or click "Restore My Session" to get your cookies back. `; // Show "I've Logged In" and "Restore My Session" buttons }}
ContextFort tracks which domains have been swapped per session:
chrome-extension/background.js
const swappedDomainsPerSession = new Map();// Example:// swappedDomainsPerSession = Map {// 123 => Set { "example.com", "api.example.com", "docs.example.com" },// 456 => Set { "github.com" }// }
Each tab group (agent session) has its own set of swapped domains. This allows multiple agent sessions to run simultaneously with different session profiles.
All session profiles are stored in Chrome’s local storage, which is encrypted at rest by Chrome’s built-in encryption.
No Cloud Sync
Session profiles are NEVER synced to cloud or transmitted externally. All data stays on your local machine.
Isolation Guarantee
Once swapped, agents cannot access human cookies unless explicitly restored by the user.
Per-Domain Profiles
Each domain has separate human and agent profiles, ensuring no cross-contamination.
Cookie Expiration: If agent cookies expire, the agent will be logged out and require re-authentication. ContextFort does not refresh expired cookies automatically.
Problem: Agent gets logged out on every page reloadSolution: Ensure you clicked “I’ve Logged In” after manually logging in. This saves the agent profile.
Problem: After agent stops, human session is not restoredSolution: This can happen if human cookies expired or were cleared externally. Use “Restore My Session” during the login prompt to preserve your human session.
Problem: Agent visits 5 different sites and all require manual loginSolution: This is expected behavior on first use. ContextFort will save all 5 agent profiles for future sessions.