Cookie prefixes are special beginnings of a cookie's name, __Secure- and __Host-, that make a supporting browser reject the cookie unless it meets stricter conditions. They are a defense against cookie injection and overwriting by less trusted code or subdomains.
Why it matters
Cookies do not carry the origin that set them. A compromised or less trusted subdomain can set a cookie for the parent domain that overrides your session cookie, enabling session fixation. A __Host- cookie cannot be set that way.
Rules enforced by the browser:
__Secure-requires theSecureattribute and a secure origin.__Host-requiresSecure,Path=/, and noDomainattribute, so the cookie is bound to the exact host.
Example
Set-Cookie: __Host-session=9f2c...; Secure; HttpOnly; Path=/; SameSite=LaxIf you add Domain=example.com to that header, the browser silently discards the cookie, which can look like a login that never sticks.
Common mistakes
- Using
__Host-while still setting aDomainattribute, so the cookie disappears. - Needing the cookie across subdomains, which
__Host-deliberately prevents. - Forgetting the prefix is case-sensitive in the name check in some browsers.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.