{"record":{"id":"2213e2e2ed3249b5","repo":"symfony/http-foundation","slug":"the-cookie-name-s-uses-the-host-prefix-which-requires-the","errorCode":null,"errorMessage":"The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie to have no \"domain\" attribute.","messagePattern":"The cookie name \"(.+?)\" uses the \"__Host-\" prefix, which requires the cookie to have no \"domain\" attribute\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"Cookie.php","lineNumber":447,"sourceCode":"    }\n\n    /**\n     * Rejects a \"__Host-\" prefixed name combined with attributes that make browsers discard the cookie.\n     *\n     * @see https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-4.1.3\n     */\n    private static function validateNamePrefix(string $name, ?bool $secure, ?string $domain, string $path): void\n    {\n        if (false === $secure && (str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-'))) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses a reserved prefix, which requires the \"secure\" flag to be enabled.', $name));\n        }\n\n        if (!str_starts_with($name, '__Host-')) {\n            return;\n        }\n\n        if ('' !== (string) $domain) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie to have no \"domain\" attribute.', $name));\n        }\n\n        if ('/' !== $path) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie path to be \"/\".', $name));\n        }\n    }\n}\n","sourceCodeStart":429,"sourceCodeEnd":455,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Cookie.php#L429-L455","documentation":"Per RFC6265bis, a cookie named with the '__Host-' prefix must not carry a Domain attribute — it must be host-only so it can never be shared across subdomains. Symfony's validateNamePrefix() throws an InvalidArgumentException when a __Host- cookie is given a non-empty domain.","triggerScenarios":"Creating a cookie named '__Host-...' with a non-null, non-empty $domain argument, or calling ->withDomain('example.com') (or any non-empty string) on an existing __Host- cookie.","commonSituations":"Sharing cookie-creation config between host-only and subdomain cookies; code that unconditionally sets the domain from a config value like APP_COOKIE_DOMAIN; renaming a legacy cookie to __Host- while keeping the old domain attribute.","solutions":["Pass null as the $domain (or omit it) for cookies named with the __Host- prefix","Remove or guard the ->withDomain() call so it is skipped for __Host- cookies","Use the '__Secure-' prefix instead if you genuinely need a shared Domain attribute","Catch \\InvalidArgumentException during config boot and fail fast with a clear message about the reserved prefix"],"exampleFix":"// before\n$cookie = Cookie::create('__Host-session', $v, 0, '/', 'example.com', true);\n// after\n$cookie = Cookie::create('__Host-session', $v, 0, '/', null, true);","handlingStrategy":"validation","validationCode":"if (str_starts_with($name, '__Host-') && null !== $domain && '' !== $domain) {\n    throw new \\InvalidArgumentException('__Host- cookies must not set a domain');\n}","typeGuard":"function isValidHostCookie(string $name, ?string $domain): bool {\n    return !str_starts_with($name, '__Host-') || null === $domain || '' === $domain;\n}","tryCatchPattern":"try {\n    $cookie = Cookie::create($name, $value, 0, '/', $domain, true);\n} catch (\\InvalidArgumentException $e) {\n    if (str_contains($e->getMessage(), '\"__Host-\" prefix, which requires the cookie to have no \"domain\"')) {\n        $cookie = Cookie::create($name, $value, 0, '/', null, true);\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Do not pipe a global APP_COOKIE_DOMAIN config into cookies that use the __Host- prefix","Decide per-cookie between host-only (__Host-) and domain-shared (__Secure-) semantics","Add a config-boot assertion that reserved-prefix cookies carry no domain","Review cookie definitions when migrating legacy cookies to __Host- names"],"tags":["php","symfony","cookie","host-prefix","rfc6265bis"],"backgroundTag":"invalid-config-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}