demo · v140

Prefix Comparator

Three cookie name prefixes — __Secure-, __Host-, and now __Http- — each enforce a different invariant. The matrix lays out which attributes are required vs forbidden vs free, and whether JS can read them. The new __Http- prefix sits at "server-set only" while remaining flexible on Path and Domain.

	(no prefix)	__Secure-	__Host-	__Http- (new)
Must be set over HTTPS	no	required	required	required
Secure attribute required	no	yes	yes	yes
Path must be /	no	no	yes	no
Domain attribute forbidden	no	no	yes	no
HttpOnly required	no	no	no	yes
Can be set from JS (document.cookie)	yes	yes	yes	no
Can be read from JS	yes	yes	yes	no (HttpOnly forced)

The point of __Http- is server-set-only assertions. __Host- rules out subdomain attacks; __Secure- rules out plaintext; __Http- rules out client tampering.

// Server (accepted):
Set-Cookie: __Http-Auth=abc123; Path=/; Secure; HttpOnly

// Client JS (rejected, silently):
document.cookie = "__Http-Auth=xyz789; path=/; Secure";  // ignored

see also