Cookie __Secure-/__Host- Prefix Validator

A session cookie can be overwritten by a compromised subdomain or over a plain HTTP connection, even when the main site is configured properly. The __Secure- and __Host- prefixes exist to shut that door: when a cookie name starts with one of them, the browser only accepts it if certain conditions are met, and silently refuses it otherwise.

Paste one or more Set-Cookie headers, one per line, and the page checks each rule. For __Secure-, the Secure attribute is enough. For __Host-, the stricter of the two, three requirements apply at once: Secure present, Path equal to a single slash, and Domain absent. That combination is what binds the cookie to the exact host that set it, with no subdomain able to create or replace it.

The browser's refusal produces no visible error — the cookie simply does not appear, and the symptom is a login that will not stick with nothing in the console. That is why it pays to check the header before shipping. A cookie without a prefix is reported as such here: not an error, just no additional protection, and the validation limits itself to saying so.