Browser security
Compatibility & evidence
Browser privacy

Secure cookie prefixes

Applies browser-enforced naming constraints to __Secure-, __Host-, __Http-, and __Host-Http- cookies.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27Not supportedAt least one required mapped feature is not available at this browser baseline.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27Not supportedAt least one required mapped feature is not available at this browser baseline.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.Set-Cookie.host_secure_prefixes
  1. 1 – 4848 recorded releases
    Not supported
  2. 49 – 155106 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 1 – 139138 recorded releases
    Not supported
  2. 140 – 15516 recorded releases
    Works

Edge

http.headers.Set-Cookie.host_secure_prefixes
  1. 12 – 187 recorded releases
    Not supported
  2. 79 – 15475 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 12 – 13967 recorded releases
    Not supported
  2. 140 – 15415 recorded releases
    Works

Firefox

http.headers.Set-Cookie.host_secure_prefixes
  1. 1 – 4952 recorded releases
    Not supported
  2. 50 – 157108 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 1 – 141144 recorded releases
    Not supported
    • Partial implementation
    • <code>__Host-Http-</code> is supported under its original name <code>__HostHttp-</code>. See <a href="https://bugzil.la/1982555">bug 1982555</a>.
  2. 1421 recorded release
    Works with limits
    • Partial implementation
    • <code>__Host-Http-</code> is supported under its original name <code>__HostHttp-</code>. See <a href="https://bugzil.la/1982555">bug 1982555</a>.
  3. 143 – 15715 recorded releases
    Works

Safari

http.headers.Set-Cookie.host_secure_prefixes
  1. 1 – 12.121 recorded releases
    Not supported
  2. 13 – 2740 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 1 – 2761 recorded releases
    Not supported

Chrome for Android

http.headers.Set-Cookie.host_secure_prefixes
  1. 18 – 4825 recorded releases
    Not supported
  2. 49 – 155106 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 18 – 139115 recorded releases
    Not supported
  2. 140 – 15516 recorded releases
    Works

Firefox for Android

http.headers.Set-Cookie.host_secure_prefixes
  1. 4 – 4943 recorded releases
    Not supported
  2. 50 – 15798 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 4 – 141125 recorded releases
    Not supported
    • Partial implementation
    • <code>__Host-Http-</code> is supported under its original name <code>__HostHttp-</code>. See <a href="https://bugzil.la/1982555">bug 1982555</a>.
  2. 1421 recorded release
    Works with limits
    • Partial implementation
    • <code>__Host-Http-</code> is supported under its original name <code>__HostHttp-</code>. See <a href="https://bugzil.la/1982555">bug 1982555</a>.
  3. 143 – 15715 recorded releases
    Works

Safari on iOS

http.headers.Set-Cookie.host_secure_prefixes
  1. 1 – 12.218 recorded releases
    Not supported
  2. 13 – 2740 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 1 – 2758 recorded releases
    Not supported

Android WebView

http.headers.Set-Cookie.host_secure_prefixes
  1. 1 – 4820 recorded releases
    Not supported
  2. 49 – 155106 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 1 – 139110 recorded releases
    Not supported
  2. 140 – 15516 recorded releases
    Works

Samsung Internet

http.headers.Set-Cookie.host_secure_prefixes
  1. 1.0 – 4.29 recorded releases
    Not supported
  2. 5.0 – 30.043 recorded releases
    Works
http.headers.Set-Cookie.http_host-http_prefixes
  1. 1.0 – 29.051 recorded releases
    Not supported
  2. 30.01 recorded release
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • Cookie scope confusion
  • Insecure cookie replacement

Does not guarantee

  • All cookie tossing
  • Cross-site scripting
  • Weak session design

What you need before using it

  • HTTPS
  • Correct Secure, Path, and Domain attributes

Fallback to keep in place

Use host-only Secure cookies with narrow scope and server-side session controls.