symfony/http-foundation · error · InvalidArgumentException

The cookie name " " uses the "__Host-" prefix, which…

Error message

The cookie name "%s" uses the "__Host-" prefix, which requires the cookie path to be "/".

What it means

Per RFC6265bis, a '__Host-' prefixed cookie must have its Path set exactly to '/', so the browser can anchor it to the whole origin. Symfony's validateNamePrefix() throws an InvalidArgumentException when a __Host- cookie is created with any other path.

Solutions

1. Pass '/' as the $path (the default) for cookies named with the __Host- prefix
2. If you need a cookie scoped to a subpath, drop the prefix and use a normal name or __Secure-
3. Guard any ->withPath() call so it is skipped or forced to '/' for __Host- cookies
4. Catch \InvalidArgumentException and surface which reserved-prefix constraint was violated in your error reporting

Example fix

// before
$cookie = Cookie::create('__Host-session', $v, 0, '/app', null, true);
// after
$cookie = Cookie::create('__Host-session', $v, 0, '/', null, true);

if (str_starts_with($name, '__Host-') && '/' !== ($path ?: '/')) {
    throw new \InvalidArgumentException('__Host- cookies must use path "/"');
}

function isValidHostCookiePath(string $name, ?string $path): bool {
    return !str_starts_with($name, '__Host-') || '/' === ($path ?: '/');
}

try {
    $cookie = Cookie::create($name, $value, 0, $path, null, true);
} catch (\InvalidArgumentException $e) {
    if (str_contains($e->getMessage(), 'requires the cookie path to be "/"')) {
        $cookie = Cookie::create($name, $value, 0, '/', null, true);
    } else {
        throw $e;
    }
}

When it happens

Trigger: Creating a cookie named '__Host-...' with $path set to e.g. '/app', '/admin', or an empty string that normalizes away from '/', or calling ->withPath('/admin') on an existing __Host- cookie.

Common situations: Scoping cookies to an application subdirectory (common when the app is deployed under a path prefix); passing the app's base path from config as the cookie path; copying path settings from a legacy non-prefixed cookie.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• The cookie name " " uses the "__Host-" prefix, which…
• The cookie name " " uses a reserved prefix, which requires…
• The "sameSite" parameter value is not valid.
• You cannot guess the extension as the Mime component is not…
• The disposition must be either

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/425ccf2d5fdb5c34. Report an issue: GitHub.

Appendix: source

Thrown at Cookie.php:451

     *
     * @see https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-4.1.3
     */
    private static function validateNamePrefix(string $name, ?bool $secure, ?string $domain, string $path): void
    {
        if (false === $secure && (str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-'))) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses a reserved prefix, which requires the "secure" flag to be enabled.', $name));
        }

        if (!str_starts_with($name, '__Host-')) {
            return;
        }

        if ('' !== (string) $domain) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses the "__Host-" prefix, which requires the cookie to have no "domain" attribute.', $name));
        }

        if ('/' !== $path) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses the "__Host-" prefix, which requires the cookie path to be "/".', $name));
        }
    }
}

View on GitHub (pinned to 5aea19cd67)