← Back to release summary

Cookie Prefixes

Category
Security
Type
New or changed feature
Status
Enabled by default (Chrome 49)
Intent stage
None

Summary

This feature adds a set of restrictions upon the names which may be used for cookies with specific properties. These restrictions enable user agents to smuggle cookie state to the server within the confines of the existing "Cookie" request header syntax, and limits the ways in which cookies may be abused. In a nutshell: `__Secure-*` cookies have to have the `Secure` flag, and `__Host-*` cookies have to have `Path=/`, can't have `Domain`, and might require `Secure` (depending on the setter).

Standards & signals

Samples: https://googlechrome.github.io/samples/cookie-prefixes/index.html

View on chromestatus.com