Glossary · Security

Cookie Prefixes (__Host- and __Secure-)

Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.

Updated October 28, 2026

Cookie prefixes are special beginnings of a cookie's name, __Secure- and __Host-, that make a supporting browser reject the cookie unless it meets stricter conditions. They are a defense against cookie injection and overwriting by less trusted code or subdomains.

Why it matters

Cookies do not carry the origin that set them. A compromised or less trusted subdomain can set a cookie for the parent domain that overrides your session cookie, enabling session fixation. A __Host- cookie cannot be set that way.

Rules enforced by the browser:

  • __Secure- requires the Secure attribute and a secure origin.
  • __Host- requires Secure, Path=/, and no Domain attribute, so the cookie is bound to the exact host.

Example

Set-Cookie: __Host-session=9f2c...; Secure; HttpOnly; Path=/; SameSite=Lax

If you add Domain=example.com to that header, the browser silently discards the cookie, which can look like a login that never sticks.

Common mistakes

  • Using __Host- while still setting a Domain attribute, so the cookie disappears.
  • Needing the cookie across subdomains, which __Host- deliberately prevents.
  • Forgetting the prefix is case-sensitive in the name check in some browsers.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecuritySession FixationSession fixation is an attack where an attacker sets a victim's session ID before login, then reuses it after the victim authenticates.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readError fix · Server errorsnginx "upstream sent too big header" 502 FixFix nginx 502 errors caused by upstream sent too big header while reading response header. Raise proxy_buffer_size or fastcgi_buffer_size correctly.4 min readGlossary · SecurityCORS (Cross-Origin Resource Sharing)CORS is a browser mechanism that uses HTTP headers to let a server permit specific other origins to read its responses, relaxing the same-origin policy.Glossary · SecurityCORS Preflight RequestA CORS preflight is an automatic OPTIONS request a browser sends to check whether a cross-origin request is allowed before sending it.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.