Cookie prefix

Meaning

A cookie prefix is a special start to a cookie's name, either __Secure- or __Host-, that makes supporting browsers enforce extra rules before accepting the cookie. MDN states that __Secure- requires the Secure attribute and a secure page, while __Host- additionally forbids a Domain attribute and requires Path=/. Because a request carries only names and values, a prefix is the one way a server can trust how a cookie was created. A misconfigured header is dropped silently. See also: Secure, Host-only cookie, Partitioned cookie, the guide "Secure, HttpOnly and the __Host- and __Secure- Prefixes".