topic
Verified 2026-09-18Cookie Name Prefixes
__Host- and __Secure- cookie prefixes let browsers enforce important cookie-setting invariants.
Use __Host- for a host-only Secure cookie with Path=/ and no Domain. Use __Secure- when Secure is required but a narrower Path or explicit Domain is necessary.
httpcookiessecuritysessions
Reference (http)
Set-Cookie: __Host-session=abc; Secure; HttpOnly; SameSite=Lax; Path=/
Use __Host- for a host-only Secure cookie with Path=/ and no Domain. Use __Secure- when Secure is required but a narrower Path or explicit Domain is necessary.
Common mistakes
- Using a __Host- cookie with Domain or a Path other than /, or assuming prefixes are enforced by non-browser HTTP clients.