// GLOSSARY

Host-only cookie and the __Host- prefix

A cookie with no Domain attribute is sent only to its own host. The __Host- prefix forbids Domain outright and requires Secure with a root Path; this is the control that actually holds against sibling subdomains in the field.