Host-only cookie

Meaning

A host-only cookie is a cookie set without a Domain attribute, so the browser returns it only to the exact host that set it. A cookie set by www.example.com this way is not sent to api.example.com or to example.com. It is the safest default because it narrows exposure, and it is a requirement for cookies that use the __Host- prefix. Choose a Domain only when you really need to share a cookie across subdomains, for example for one sign-in across a product. See also: Domain, Cookie prefix, Path, the guide "Domain, Path, Expires and Max-Age Explained".