The cookie breaks the rules of its __Host- or __Secure- prefix.

COOKIE_PREFIX_INVALID · Severity: Error

• ErrorCOOKIE_PREFIX_INVALID

  The cookie breaks the rules of its __Host- or __Secure- prefix.

  A cookie named __Secure-... must have Secure. A cookie named __Host-... must have Secure, Path=/ and no Domain. Browsers reject a cookie that breaks the rules, so it is never set. The evidence names the broken rule.

  Recommendation: Add or remove the attributes named in the evidence.

Reported by

• Set-Cookie parser

Available through the API

• Set-Cookie parser API

Related findings

• Error COOKIE_INVALID The Set-Cookie value has no valid name=value pair.
• Info COOKIE_LONG_LIFETIME The cookie asks to live longer than the 400 days browsers allow.
• Info COOKIE_MULTIPLE The text holds more than one cookie; only the first was checked.
• Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.
• Info COOKIE_NO_HTTPONLY The cookie can be read by scripts (no HttpOnly attribute).
• Info COOKIE_NO_SAMESITE The cookie has no SameSite attribute.

All findings