goldstrap / account
Account and cookies
A few features need Goldstrap to know who is signed in. That needs your Roblox session cookie, so it is off until you turn it on, and this page explains exactly what happens then.
The switch
Settings → Bootstrapper → Allow cookie access
Off by default. It lives under the experimental section on purpose: it is the one setting here that deals with a credential.
What it enables
| Feature | Why it needs the cookie |
|---|---|
| Private Roblox channels | The token that unlocks a private build is issued to your account. |
| Age-restricted games | Roblox hides those game details from signed-out requests. |
| Account name in Discord status | Showing your avatar and name is an authenticated lookup. |
| Accurate thumbnails | Some images are only returned for the signed-in user. |
Everything else — installing, launching, mods, Fast Flags, the profile row — works with the switch off.
How it is read
Roblox stores its own cookies in %LOCALAPPDATA%\Roblox\LocalStorage\RobloxCookies.dat, encrypted with Windows DPAPI for your user account. Goldstrap decrypts that file in memory, takes only the .ROBLOSECURITY entry, and keeps it in memory for the session.
- It is never written to disk by Goldstrap, and never appears in the log.
- It is only attached to requests whose host is
roblox.comor a subdomain of it. - It is not sent to the update check, the geolocation lookup, the thumbnail proxy or any third-party service.
The honest part
A session cookie is a credential: anyone who has it can act as you until it is revoked. Goldstrap reads it from a file Roblox already wrote on your machine and only sends it back to Roblox — but if you are not comfortable with a third-party program holding it in memory, leave the switch off. Nothing else in Goldstrap depends on it.
To revoke a session regardless of Goldstrap: sign out of Roblox, or use Settings → Security on roblox.com and sign out of other sessions.
Turning it off
Switch it off and restart Goldstrap; the copy in memory is gone with the process. Private channels fall back to the public one, and the account line in Discord disappears.