ASVS 5.0 V3.3.3 requires that cookies carry the __Host- name prefix unless they are explicitly designed to be shared with other hosts. It is a Level 2 requirement, and it builds on V3.3.1.
Why it matters
A cookie without the prefix can be overwritten by any sibling subdomain, or by a plain HTTP response on a network the attacker controls. That enables session fixation and cookie tossing, where the attacker plants a cookie of their own that your application then trusts. The __Host- prefix makes the browser refuse such cookies.
How to implement it
The browser accepts a __Host- cookie only if it has Secure, Path=/, no Domain attribute, and arrives over HTTPS.
Set-Cookie: __Host-session=abc123; Secure; HttpOnly; Path=/; SameSite=Lax
Rename each application cookie, and update the code that reads it. If you run a session migration, accept both names for a short period, then drop the old one. Cookies that must span subdomains keep __Secure- with a deliberate Domain, and should be listed in your documentation.
How to test it
Inspect cookies in the browser storage panel: names should start with __Host- and show no domain scope. Try setting the same cookie from a sibling subdomain or with a Domain attribute and confirm the browser rejects it.
Migrating and edge cases
Moving to prefixed names touches several places: the code that sets the cookie, the code that reads it, load balancer rules that look for a session cookie by name, logging filters that redact it, and monitoring checks. Search the whole repository, and the infrastructure configuration, for the old name before you rename.
Local development over plain HTTP will not accept __Host- cookies, except on localhost in most browsers. Test against a real HTTPS staging host. Frameworks with multiple cookies, such as a separate CSRF cookie or a remember me token, need the same change. Single sign on across subdomains is the legitimate exception, and in that case the shared cookie keeps __Secure- and goes in your documentation.
Common mistakes
- Adding
Domainto a__Host-cookie, which causes it to be ignored. - Setting
Pathto a subfolder.
Quick check
Why does a __Host- cookie need Path=/?
So it applies to the whole origin and cannot be shadowed by another cookie scoped to a narrower path.
