demo · v140
XSS Attempt
The chromestatus motivation: an attacker who breaks past your CSP can drop cookies via document.cookie that look identical to your server-set ones. __Http blocks that — the browser refuses any client-side write to a name with the prefix. Trigger an XSS scenario and watch the cookies the browser actually accepts.
cookies the browser currently has stored:
event log:
Idle.
// server header — gets accepted
Set-Cookie: __Http-session=abc123; Path=/; Secure; HttpOnly
// JS attempt — rejected by Chrome 140+
document.cookie = "__Http-session=hijacked"; // ignored
// __HostHttp = __Http + path-and-host restrictions:
Set-Cookie: __HostHttp-csrf=tok; Path=/; Secure; HttpOnly; SameSite=Lax