symfony/http-foundation · error · InvalidArgumentException

The cookie name " " uses the "__Host-" prefix, which…

Error message

The cookie name "%s" uses the "__Host-" prefix, which requires the cookie to have no "domain" attribute.

What it means

Per RFC6265bis, a cookie named with the '__Host-' prefix must not carry a Domain attribute — it must be host-only so it can never be shared across subdomains. Symfony's validateNamePrefix() throws an InvalidArgumentException when a __Host- cookie is given a non-empty domain.

Solutions

1. Pass null as the $domain (or omit it) for cookies named with the __Host- prefix
2. Remove or guard the ->withDomain() call so it is skipped for __Host- cookies
3. Use the '__Secure-' prefix instead if you genuinely need a shared Domain attribute
4. Catch \InvalidArgumentException during config boot and fail fast with a clear message about the reserved prefix

Example fix

// before
$cookie = Cookie::create('__Host-session', $v, 0, '/', 'example.com', true);
// after
$cookie = Cookie::create('__Host-session', $v, 0, '/', null, true);

if (str_starts_with($name, '__Host-') && null !== $domain && '' !== $domain) {
    throw new \InvalidArgumentException('__Host- cookies must not set a domain');
}

function isValidHostCookie(string $name, ?string $domain): bool {
    return !str_starts_with($name, '__Host-') || null === $domain || '' === $domain;
}

try {
    $cookie = Cookie::create($name, $value, 0, '/', $domain, true);
} catch (\InvalidArgumentException $e) {
    if (str_contains($e->getMessage(), '"__Host-" prefix, which requires the cookie to have no "domain"')) {
        $cookie = Cookie::create($name, $value, 0, '/', null, true);
    } else {
        throw $e;
    }
}

When it happens

Trigger: Creating a cookie named '__Host-...' with a non-null, non-empty $domain argument, or calling ->withDomain('example.com') (or any non-empty string) on an existing __Host- cookie.

Common situations: Sharing cookie-creation config between host-only and subdomain cookies; code that unconditionally sets the domain from a config value like APP_COOKIE_DOMAIN; renaming a legacy cookie to __Host- while keeping the old domain attribute.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• The cookie name " " uses the "__Host-" prefix, which…
• The cookie name " " uses a reserved prefix, which requires…
• The "sameSite" parameter value is not valid.
• You cannot guess the extension as the Mime component is not…
• The disposition must be either

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/2213e2e2ed3249b5. Report an issue: GitHub.

Appendix: source

Thrown at Cookie.php:447

    }

    /**
     * Rejects a "__Host-" prefixed name combined with attributes that make browsers discard the cookie.
     *
     * @see https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-4.1.3
     */
    private static function validateNamePrefix(string $name, ?bool $secure, ?string $domain, string $path): void
    {
        if (false === $secure && (str_starts_with($name, '__Secure-') || str_starts_with($name, '__Host-'))) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses a reserved prefix, which requires the "secure" flag to be enabled.', $name));
        }

        if (!str_starts_with($name, '__Host-')) {
            return;
        }

        if ('' !== (string) $domain) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses the "__Host-" prefix, which requires the cookie to have no "domain" attribute.', $name));
        }

        if ('/' !== $path) {
            throw new \InvalidArgumentException(\sprintf('The cookie name "%s" uses the "__Host-" prefix, which requires the cookie path to be "/".', $name));
        }
    }
}

View on GitHub (pinned to 5aea19cd67)