Browser & Web Performance · Senior · Question 55 of 75

What does the `__Host-` cookie name prefix guarantee?

Set-Cookie: __Host-session=abc; Secure; Path=/; HttpOnly; SameSite=Lax

✓Correct answer: The cookie was set over HTTPS by this exact host, with Path=/ and no Domain, so subdomains can't set or override it
2The cookie is shared with all subdomains
3The cookie is encrypted by the browser

Explanation

It defends against cookie tossing from a compromised or user-controlled subdomain.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.