// GLOSSARY

Host-only Cookie and the __Host- Prefix

A cookie with no Domain attribute is sent only to its own host and does not leak to sibling subdomains; this is a host-only cookie. The __Host- prefix makes this guarantee mandatory at the browser level: in a cookie whose name begins with this prefix it forbids Domain outright, requires the Secure flag and forces Path to be root (/). The matter is not theoretical but one of an architectural trust boundary: the real protection against cookie tossing and the related-domain attacker position must rest not on the developer remembering the right attributes on every cookie but on the browser refusing a wrong definition from the start. Security left to human attention is eventually skipped once; security enforced by the browser holds on every request. So on critical cookies such as the session identifier, the __Host- prefix is the most robust control that prevents the cookie from being overwritten or shadowed even if the attacker seizes a subdomain sharing the same registrable domain (eTLD+1).