Headers Security
low Severity
Free Check
Cookie Prefix Hardening (__Host- and __Secure-)
Validates that sensitive authentication tokens leverage browser cookie prefixes (__Host- or __Secure-) to prevent cookie tossing.
Why It Matters
Cookie prefixes instruct the browser to refuse cookie modifications from subdomains or non-secure origins.
How We Check This
We inspect session cookies to verify if prefixes (__Host- or __Secure-) are utilized for high-value tokens.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
# Use prefixed cookie names in your application layer: __Host-session_id
Frequently Asked Questions
What restrictions does __Host- enforce?
It must be set with Secure, path=/, and without a Domain attribute, binding it exclusively to the host origin.