demo · v140

__Http- Cookie Prefix Simulator

Build a Set-Cookie header on the left. The simulator below applies the v140 acceptance rules for the __Http- prefix and tells you why the browser would accept or reject it.

name

value

path

domain (optional)

HttpOnly Secure SameSite=Lax

Resulting Set-Cookie header:

// v140 enforces these invariants for __Http- prefix:
//   1. Must have HttpOnly
//   2. Must have Secure
//   3. Must have Path=/
// If any are missing the browser rejects the Set-Cookie.

see also