demo · v140

XSS Attempt

The chromestatus motivation: an attacker who breaks past your CSP can drop cookies via document.cookie that look identical to your server-set ones. __Http blocks that — the browser refuses any client-side write to a name with the prefix. Trigger an XSS scenario and watch the cookies the browser actually accepts.

cookies the browser currently has stored:

event log:

Idle.

// server header — gets accepted
Set-Cookie: __Http-session=abc123; Path=/; Secure; HttpOnly

// JS attempt — rejected by Chrome 140+
document.cookie = "__Http-session=hijacked";  // ignored

// __HostHttp = __Http + path-and-host restrictions:
Set-Cookie: __HostHttp-csrf=tok; Path=/; Secure; HttpOnly; SameSite=Lax

see also