Cookie attributes: Secure, HttpOnly, SameSite, Domain, Path and the __Host- prefix

What it is

A Set-Cookie header carries a name, a value and attributes. RFC 6265 and its successor draft (rfc6265bis, which adds SameSite and prefixes) define them:

• Domain: omitted, the cookie returns only to the origin host (host-only). Set to example.com, it is sent to that host and every subdomain. A value that does not cover the origin is rejected, and RFC 6265 notes that many user agents also reject public suffixes such as co.uk.
• Path: defaults to the directory of the request path; matching is prefix-based. RFC 6265 says it "cannot be relied upon for security".
• Secure: sent only over secure channels. RFC 6265 warns that it protects confidentiality, not integrity; the draft adds that non-secure origins cannot overwrite an existing secure cookie.
• HttpOnly: omitted from non-HTTP APIs such as document.cookie, still sent with fetch and XMLHttpRequest.
• SameSite: Strict sends only on same-site requests; Lax also on cross-site top-level navigations with safe methods; None sends everywhere and is rejected unless Secure is also set. MDN notes that some browsers treat a missing attribute as Lax.
• Max-Age and Expires: Max-Age wins when both are present; neither makes a session cookie.
• Prefixes: a name starting with __Secure- is accepted only with Secure; __Host- additionally requires Path=/ and no Domain, so the cookie is locked to one host. The draft states that ports are the only piece of the origin model that __Host- cookies continue to ignore.

Why it matters

Cookies are not bound to origins. RFC 6265 states that they provide isolation neither by port nor by scheme; a subdomain can set a cookie for its parent domain and shadow the parent's own. The Cookie request header carries no attributes, so the server cannot tell how a cookie was set; the prefixes exist to give it that certainty.

How to apply

• Session cookie: __Host-session=<id>; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=<seconds>.
• Omit Domain unless subdomains must share the cookie, and then accept that every subdomain can overwrite it.
• SameSite=Strict for cookies used only inside the application; Lax for logins that must survive arriving through an external link; None only for embedded cross-site use, always with Secure.
• Do not separate two applications on one host by Path; give them separate hosts.
• Delete by re-setting with the same name, Domain and Path and Max-Age=0.

Pitfalls

A leading dot in Domain is ignored, a trailing dot makes the attribute ignored. RFC 6265 says general-use user agents should support at least 4096 bytes per cookie and 50 cookies per domain; beyond such limits cookies may be dropped silently. Two services on different ports of one host see each other's cookies.