{"record":{"id":"425ccf2d5fdb5c34","repo":"symfony/http-foundation","slug":"the-cookie-name-s-uses-the-host-prefix-which-requires-the-425ccf","errorCode":null,"errorMessage":"The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie path to be \"/\".","messagePattern":"The cookie name \"(.+?)\" uses the \"__Host-\" prefix, which requires the cookie path to be \"/\"\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"Cookie.php","lineNumber":451,"sourceCode":"     *\n     * @see https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-4.1.3\n     */\n    private static function validateNamePrefix(string $name, ?bool $secure, ?string $domain, string $path): void\n    {\n        if (false === $secure && (str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-'))) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses a reserved prefix, which requires the \"secure\" flag to be enabled.', $name));\n        }\n\n        if (!str_starts_with($name, '__Host-')) {\n            return;\n        }\n\n        if ('' !== (string) $domain) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie to have no \"domain\" attribute.', $name));\n        }\n\n        if ('/' !== $path) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie path to be \"/\".', $name));\n        }\n    }\n}\n","sourceCodeStart":433,"sourceCodeEnd":455,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Cookie.php#L433-L455","documentation":"Per RFC6265bis, a '__Host-' prefixed cookie must have its Path set exactly to '/', so the browser can anchor it to the whole origin. Symfony's validateNamePrefix() throws an InvalidArgumentException when a __Host- cookie is created with any other path.","triggerScenarios":"Creating a cookie named '__Host-...' with $path set to e.g. '/app', '/admin', or an empty string that normalizes away from '/', or calling ->withPath('/admin') on an existing __Host- cookie.","commonSituations":"Scoping cookies to an application subdirectory (common when the app is deployed under a path prefix); passing the app's base path from config as the cookie path; copying path settings from a legacy non-prefixed cookie.","solutions":["Pass '/' as the $path (the default) for cookies named with the __Host- prefix","If you need a cookie scoped to a subpath, drop the prefix and use a normal name or __Secure-","Guard any ->withPath() call so it is skipped or forced to '/' for __Host- cookies","Catch \\InvalidArgumentException and surface which reserved-prefix constraint was violated in your error reporting"],"exampleFix":"// before\n$cookie = Cookie::create('__Host-session', $v, 0, '/app', null, true);\n// after\n$cookie = Cookie::create('__Host-session', $v, 0, '/', null, true);","handlingStrategy":"validation","validationCode":"if (str_starts_with($name, '__Host-') && '/' !== ($path ?: '/')) {\n    throw new \\InvalidArgumentException('__Host- cookies must use path \"/\"');\n}","typeGuard":"function isValidHostCookiePath(string $name, ?string $path): bool {\n    return !str_starts_with($name, '__Host-') || '/' === ($path ?: '/');\n}","tryCatchPattern":"try {\n    $cookie = Cookie::create($name, $value, 0, $path, null, true);\n} catch (\\InvalidArgumentException $e) {\n    if (str_contains($e->getMessage(), 'requires the cookie path to be \"/\"')) {\n        $cookie = Cookie::create($name, $value, 0, '/', null, true);\n    } else {\n        throw $e;\n    }\n}","preventionTips":["For __Host- cookies always use the default path '/'","Do not pass the app's deployment sub-path as the cookie path for prefixed cookies","Use the __Secure- prefix when you need a sub-path scoped cookie","Add a unit test per reserved-prefix cookie verifying name/domain/path/secure constraints"],"tags":["php","symfony","cookie","host-prefix","path","rfc6265bis"],"backgroundTag":"invalid-config-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}