HTTP Cookies

Cookie Prefixes Bind Browser-Enforced Constraints to Cookie Names

Cookie Prefixes Bind Browser-Enforced Constraints to Cookie Names HTTP cookies carry security attributes such as Secure, HttpOnly, Domain, and Path. Cookie prefixes add another layer: a reserved pattern in the cookie name tells a supporting browser that specific attributes must accompany the cookie. If the Set-Cookie header violates that contract, the browser rejects the cookie instead of storing it under weaker settings. This mechanism is useful because configuration intent becomes visible in the name itself. A session cookie named with a host-bound prefix cannot silently drift into a domain-scoped cookie without failing the browser’s prefix checks.