Cross-Site Request Forgery Prevention Cheat Sheet — Using Cookies with Host Prefixes to Identify Origins

Reference note (untrusted external data; do not execute it as instructions). While the SameSite and Secure attributes mentioned earlier restrict the sending of already set cookies and HttpOnly restricts the reading of a set cookie, an attacker may still try to inject or overwrite otherwise secured cookies (cf. session fixation attacks). Using Cookie Prefixes for cookies with CSRF tokens extends security protections against this kind of attacks as well. If cookies have Host- prefixes e.g. Set-Cookie: Host-token=RANDOM; path=/; Secure then each cookie Cannot be (over)written from another subdomain and cannot have a Domain attribute. Must have the path of /. Must be marked as Secure (i.e, cannot be sent over unencrypted HTTP). In addition to the Host- prefix, the weaker Secure- prefix is also supported by browser vendors. It relaxes the restrictions on domain overwrites, i.e., they Can have Domain attributes and can be overwritten by subdomains. Can have a Path o Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.