topic
Verified 2026-09-18

Cookie Prefixes

Cookie name prefixes let supporting browsers enforce extra constraints on how a cookie is set.

__Secure- requires Secure and an HTTPS setting context. __Host- also requires Path=/ and no Domain. Newer __Http- and __Host-Http- prefixes add HttpOnly requirements where supported.

httpcookiessecurity

Reference (http)

Set-Cookie: __Host-session=abc123; Secure; HttpOnly; Path=/

__Secure- requires Secure and an HTTPS setting context. __Host- also requires Path=/ and no Domain. Newer __Http- and __Host-Http- prefixes add HttpOnly requirements where supported.

Common mistakes

  • Checking only the value and ignoring the full prefixed cookie name or browser support.

Sources

Permalink: https://merginit.com/reference/http/cookie-prefixes