{"record":{"id":"a5017038abaddc0b","repo":"symfony/http-foundation","slug":"the-cookie-name-s-uses-a-reserved-prefix-which-requires-the","errorCode":null,"errorMessage":"The cookie name \"%s\" uses a reserved prefix, which requires the \"secure\" flag to be enabled.","messagePattern":"The cookie name \"(.+?)\" uses a reserved prefix, which requires the \"secure\" flag to be enabled\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"Cookie.php","lineNumber":439,"sourceCode":"    }\n\n    /**\n     * @param bool $default The default value of the \"secure\" flag when it is set to null\n     */\n    public function setSecureDefault(bool $default): void\n    {\n        $this->secureDefault = $default;\n    }\n\n    /**\n     * Rejects a \"__Host-\" prefixed name combined with attributes that make browsers discard the cookie.\n     *\n     * @see https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-4.1.3\n     */\n    private static function validateNamePrefix(string $name, ?bool $secure, ?string $domain, string $path): void\n    {\n        if (false === $secure && (str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-'))) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses a reserved prefix, which requires the \"secure\" flag to be enabled.', $name));\n        }\n\n        if (!str_starts_with($name, '__Host-')) {\n            return;\n        }\n\n        if ('' !== (string) $domain) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie to have no \"domain\" attribute.', $name));\n        }\n\n        if ('/' !== $path) {\n            throw new \\InvalidArgumentException(\\sprintf('The cookie name \"%s\" uses the \"__Host-\" prefix, which requires the cookie path to be \"/\".', $name));\n        }\n    }\n}\n","sourceCodeStart":421,"sourceCodeEnd":455,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Cookie.php#L421-L455","documentation":"Per RFC6265bis section 4.1.3, cookie names prefixed with '__Secure-' or '__Host-' must have the Secure flag so browsers can treat them as HTTPS-only guarantees. Symfony enforces this in validateNamePrefix() and throws an InvalidArgumentException if such a cookie is created with secure === false.","triggerScenarios":"Constructing or modifying a cookie named '__Secure-foo' or '__Host-foo' with the $secure constructor parameter explicitly false, or calling ->withSecure(false) on such a cookie. Note secure=null (auto-detect) passes this check; only an explicit false throws.","commonSituations":"Renaming an existing cookie to a __Secure-/__Host- prefix without enabling HTTPS-only mode; local HTTP development environments forcing secure=false; code calling withSecure(false) to relax cookies in dev config.","solutions":["Set the $secure parameter to true (or leave null to auto-detect HTTPS) when the name starts with __Secure- or __Host-","Serve the site over HTTPS and remove any dev-mode code that forces secure=false","Rename the cookie to drop the reserved prefix if you cannot guarantee the Secure flag","Catch \\InvalidArgumentException and log a misconfiguration warning pointing at the cookie name"],"exampleFix":"// before\n$cookie = Cookie::create('__Host-session', $v, 0, '/', null, false);\n// after\n$cookie = Cookie::create('__Host-session', $v, 0, '/', null, true);","handlingStrategy":"validation","validationCode":"if ((str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-')) && $secure === false) {\n    throw new \\InvalidArgumentException('Reserved cookie prefix requires secure=true');\n}","typeGuard":"function isReservedPrefixCookie(string $name): bool {\n    return str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-');\n}","tryCatchPattern":"try {\n    $cookie = Cookie::create($name, $value, 0, '/', $domain, $secure);\n} catch (\\InvalidArgumentException $e) {\n    if (str_contains($e->getMessage(), 'reserved prefix')) {\n        $cookie = Cookie::create($name, $value, 0, '/', $domain, true);\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Never hard-code secure=false for cookies with reserved __Secure-/__Host- prefixes","Leave $secure as null (auto-detect HTTPS) rather than false unless you have a specific reason","Test cookie creation in both HTTP and HTTPS environments","Keep dev/test configs from overriding the secure flag for security-sensitive cookie names"],"tags":["php","symfony","cookie","secure-flag","rfc6265bis"],"backgroundTag":"invalid-config-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}