symfony/http-foundation · error · InvalidArgumentException

The cookie name " " uses a reserved prefix, which requires…

Error message

The cookie name "%s" uses a reserved prefix, which requires the "secure" flag to be enabled.

What it means

Per RFC6265bis section 4.1.3, cookie names prefixed with '__Secure-' or '__Host-' must have the Secure flag so browsers can treat them as HTTPS-only guarantees. Symfony enforces this in validateNamePrefix() and throws an InvalidArgumentException if such a cookie is created with secure === false.

Solutions

1. Set the $secure parameter to true (or leave null to auto-detect HTTPS) when the name starts with __Secure- or __Host-
2. Serve the site over HTTPS and remove any dev-mode code that forces secure=false
3. Rename the cookie to drop the reserved prefix if you cannot guarantee the Secure flag
4. Catch \InvalidArgumentException and log a misconfiguration warning pointing at the cookie name

Example fix

// before
$cookie = Cookie::create('__Host-session', $v, 0, '/', null, false);
// after
$cookie = Cookie::create('__Host-session', $v, 0, '/', null, true);

if ((str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-')) && $secure === false) {
    throw new \InvalidArgumentException('Reserved cookie prefix requires secure=true');
}

function isReservedPrefixCookie(string $name): bool {
    return str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-');
}

try {
    $cookie = Cookie::create($name, $value, 0, '/', $domain, $secure);
} catch (\InvalidArgumentException $e) {
    if (str_contains($e->getMessage(), 'reserved prefix')) {
        $cookie = Cookie::create($name, $value, 0, '/', $domain, true);
    } else {
        throw $e;
    }
}

When it happens

Trigger: Constructing or modifying a cookie named '__Secure-foo' or '__Host-foo' with the $secure constructor parameter explicitly false, or calling ->withSecure(false) on such a cookie. Note secure=null (auto-detect) passes this check; only an explicit false throws.

Common situations: Renaming an existing cookie to a __Secure-/__Host- prefix without enabling HTTPS-only mode; local HTTP development environments forcing secure=false; code calling withSecure(false) to relax cookies in dev config.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• The cookie name " " uses the "__Host-" prefix, which…
• The cookie name " " uses the "__Host-" prefix, which…
• The "sameSite" parameter value is not valid.
• You cannot guess the extension as the Mime component is not…
• The disposition must be either

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/a5017038abaddc0b. Report an issue: GitHub.

Appendix: source

Thrown at Cookie.php:439

    }

    /**
     * @param bool $default The default value of the "secure" flag when it is set to null
     */
    public function setSecureDefault(bool $default): void
    {
        $this->secureDefault = $default;
    }

    /**
     * Rejects a "__Host-" prefixed name combined with attributes that make browsers discard the cookie.
     *
     * @see https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-4.1.3
     */
    private static function validateNamePrefix(string $name, ?bool $secure, ?string $domain, string $path): void
    {
        if (false === $secure && (str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-'))) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses a reserved prefix, which requires the "secure" flag to be enabled.', $name));
        }

        if (!str_starts_with($name, '__Host-')) {
            return;
        }

        if ('' !== (string) $domain) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses the "__Host-" prefix, which requires the cookie to have no "domain" attribute.', $name));
        }

        if ('/' !== $path) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses the "__Host-" prefix, which requires the cookie path to be "/".', $name));
        }
    }
}

View on GitHub (pinned to 5aea19cd67)