Cookie name prefixes (__Host- / __Secure-)

Scan.now looks at the names of the cookies set on the response to /. It reports, as information, whether the session-like cookies use a prefix, and it validates any prefixed cookie against the rules browsers enforce: a __Secure- cookie must carry the Secure attribute and be set from an HTTPS origin; a __Host- cookie must additionally have Path=/ and no Domain attribute. A prefixed cookie that breaks its rule is flagged, because the browser rejects it silently and the application will behave as if the cookie was never set. Unprefixed session cookies are reported as an opportunity rather than a fault: prefixes are a hardening step on top of the flags checked in cookie-secure-flag, cookie-httponly-flag and cookie-samesite.

Cookies have a weaker isolation model than the rest of the web platform. A cookie for example.com can be set by any subdomain (blog.example.com, an abandoned old.example.com that someone has taken over) and, in browsers without the Secure-overwrite protection, by a plain-HTTP response for the same host. When the server reads session=..., it cannot tell where that cookie came from. That enables session fixation: the attacker plants a session identifier they already know, waits for the victim to log in under it, and then uses it. It also enables cookie tossing, where a subdomain sets a cookie with a more specific path that shadows the real one. The __Host- prefix closes both: a browser will only accept a __Host- cookie if it was set over HTTPS by the exact host, with Path=/ and no Domain, so the server knows those conditions held. The cookie flags guide explains the prefixes alongside the attributes.

Rename the session cookie and satisfy the prefix rules:

Set-Cookie: __Host-session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

Express with express-session:

app.use(session({
  name: '__Host-sid',
  cookie: { path: '/', secure: true, httpOnly: true, sameSite: 'lax' },  // no domain
}));

Django (settings.py):

SESSION_COOKIE_NAME = '__Host-sessionid'
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_DOMAIN = None
SESSION_COOKIE_PATH = '/'
CSRF_COOKIE_NAME = '__Host-csrftoken'
CSRF_COOKIE_SECURE = True

PHP: session.name = __Host-PHPSESSID with session.cookie_secure = 1, session.cookie_path = / and an empty session.cookie_domain. Use __Secure- instead when the cookie must be shared across subdomains (it still requires Secure). Renaming a session cookie logs everyone out once, so deploy it at a quiet time and make sure any code or proxy rule that references the old name is updated.