v140 · miscellaneous

Http cookie prefix

There are cases where it's important to distinguish on the server side between cookies that were set by the server and ones that were set by the client. One such case is cookies that are normally always set by the server, unless some unexpected code (an XSS exploit, a malicious extension, a commit from a confused developer, etc.) happens to set them on th

concepts

  1. Cookie Prefix

    __Http- cookie name prefix — server-asserted invariants on the cookie. The browser enforces HttpOnly + Secure + Path=/ regardless of the cookie's actual attributes.

  2. XSS Attempt

    The XSS motivation in action: trigger a malicious document.cookie write against a __Http- cookie and watch the browser reject it while the unprotected cookie gets clobbered.

  3. Prefix Comparator

    The full matrix: __Secure-, __Host-, and __Http- side by side. Which attributes each prefix requires, forbids, or leaves free, plus JS readability.

  4. Header Inspector

    Paste raw Set-Cookie headers and the inspector validates them against all three prefixes plus SameSite/Secure sanity. Triage tool for misbehaving cookie jars.

  5. Attack Walkthrough

    Step-by-step XSS scenario where the attacker tries to overwrite the session cookie. Toggle between unprefixed, __Secure-, and __Http- and see exactly which step finally stops the attack.

why it shipped

Server operators need to ensure that certain cookies that they receive were indeed set by them, and not by a malicious/compromised script.

references