Web Security · Middle · Question 46 of 75

What does the `__Host-` cookie name prefix guarantee?

1The cookie is sent only to the host's IP address
2The cookie is encrypted by the host
✓Correct answer: The cookie was set with Secure, without Domain, with Path=/, so subdomains can't set or override it

Explanation

Browsers reject __Host- cookies that don't meet these rules. That protects session cookies from being overwritten by a compromised subdomain.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.