Skip to content

Rename __HostHttp- to __Host-Http- for improved backwards compat #3153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
annevk merged 2 commits into from
Aug 12, 2025
Merged

Rename __HostHttp- to __Host-Http- for improved backwards compat #3153

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
72e6b12
Rename __HostHttp- to __Host-Http- for improved backwards compat
yoavweiss Aug 11, 2025
280ac04
Also change the processing model
yoavweiss Aug 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions draft-ietf-httpbis-layered-cookies.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -679,10 +679,10 @@ This helps developers and server operators to know that the cookie was set using
a `Set-Cookie` header, and is limited in scope to HTTP requests.


#### The "__HostHttp-" prefix
#### The "__Host-Http-" prefix

If a cookie's name begins with a case-sensitive match for the string
`__HostHttp-`, then the cookie will have been set with a `Secure` attribute, an
`__Host-Http-`, then the cookie will have been set with a `Secure` attribute, an
`HttpOnly` attribute, a `Path` attribute with a value of `/`, and no `Domain` attribute.

This helps developers and server operators to know that the cookie was set using
Expand Down Expand Up @@ -1305,7 +1305,7 @@ boolean _httpOnlyAllowed_, boolean _allowNonHostOnlyCookieForPublicSuffix_, and

1. If _cookie_'s name, byte-lowercased, starts with `__http-` and _cookie_ is not Http-prefix compatible, then return null.

1. If _cookie_'s name, byte-lowercased, starts with `__hosthttp-` and _cookie_ is not both Host-prefix compatible and Http-prefix compatible, then return null.
1. If _cookie_'s name, byte-lowercased, starts with `__host-http-` and _cookie_ is not both Host-prefix compatible and Http-prefix compatible, then return null.

1. If _cookie_'s name is the empty byte sequence and one of the following is true:

Expand All @@ -1315,7 +1315,7 @@ boolean _httpOnlyAllowed_, boolean _allowNonHostOnlyCookieForPublicSuffix_, and

* _cookie_'s value, byte-lowercased, starts with `__http-`, or

* _cookie_'s value, byte-lowercased, starts with `__hosthttp-`,
* _cookie_'s value, byte-lowercased, starts with `__host-http-`,

then return null.

Expand Down