https://nalar.dev/tags/http-cookies/ Recent content in HTTP Cookies on Nalar Hugo en-us Tue, 22 Sep 2026 00:00:00 +0000 https://nalar.dev/cookie-prefixes-bind-browser-enforced-constraints-to-cookie-names/ Tue, 22 Sep 2026 00:00:00 +0000 https://nalar.dev/cookie-prefixes-bind-browser-enforced-constraints-to-cookie-names/ <h1 id="cookie-prefixes-bind-browser-enforced-constraints-to-cookie-names">Cookie Prefixes Bind Browser-Enforced Constraints to Cookie Names</h1> <p>HTTP cookies carry security attributes such as <code>Secure</code>, <code>HttpOnly</code>, <code>Domain</code>, and <code>Path</code>. Cookie prefixes add another layer: a reserved pattern in the cookie name tells a supporting browser that specific attributes must accompany the cookie. If the <code>Set-Cookie</code> header violates that contract, the browser rejects the cookie instead of storing it under weaker settings.</p> <p>This mechanism is useful because configuration intent becomes visible in the name itself. A session cookie named with a host-bound prefix cannot silently drift into a domain-scoped cookie without failing the browser&rsquo;s prefix checks.</p>