topic
Verified 2026-09-18Cookie Prefixes
Cookie name prefixes let supporting browsers enforce extra constraints on how a cookie is set.
__Secure- requires Secure and an HTTPS setting context. __Host- also requires Path=/ and no Domain. Newer __Http- and __Host-Http- prefixes add HttpOnly requirements where supported.
httpcookiessecurity
Reference (http)
Set-Cookie: __Host-session=abc123; Secure; HttpOnly; Path=/
__Secure- requires Secure and an HTTPS setting context. __Host- also requires Path=/ and no Domain. Newer __Http- and __Host-Http- prefixes add HttpOnly requirements where supported.
Common mistakes
- Checking only the value and ignoring the full prefixed cookie name or browser support.