Editorial review: Document __Http- and __Host-Http- cookie prefixes

[chrisdavidmills]

Description

Chrome 140 adds support for the __Http- and __Host-Http- cookie prefixes: see https://chromestatus.com/feature/5170139586363392, and also see https://github.com/httpwg/http-extensions/blob/main/draft-ietf-httpbis-layered-cookies.md#the-__http--prefix for further info.

This PR documents the new prefixes.

Can you give me a technical review, @yoavweiss?

Motivation

Additional details

Related issues and pull requests

[github-actions]

Preview URLs

• /en-US/docs/Web/API/Document/cookie
• /en-US/docs/Web/HTTP/Guides/Cookies
• /en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie

Flaws (4)

Note! 2 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/HTTP/Guides/Cookies
Title: Using HTTP cookies
Flaw count: 4

• unknown:
  • Error opening /shared-assets/images/diagrams/http/cookies/cookie-basic-example.png: No such file or directory (os error 2)
  • No generic content config found
  • no blog root
  • no blog root

External URLs (2)

URL: /en-US/docs/Web/HTTP/Guides/Cookies
Title: Using HTTP cookies

• https://en.wikipedia.org/wiki/Defense_in_depth_(computing) (1 time) (Note! This may be a new URL 👀)
• https://owasp.org/www-community/attacks/Session_fixation (3 times) (Note! This may be a new URL 👀)

(comment last updated: 2025-09-01 15:25:16)

[yoavweiss]

LGTM

[bsmth]

I actually missed that this section is under "Examples", so there's some small duplication, but it's also okay in this state, IMO.

[bsmth]

Thanks Chris! Maybe you want to de-dupe some of the information in the Set-Cookie page for cookie prefixes, but I think it's good either way! Reiterating before the example is also fine 👍🏻