Cookies are attached to requests according to browser rules, not according to the server component that originally set them. A broad Domain or Path can expose state to unrelated routes or subdomains, while missing transport and script restrictions enlarge the damage from other failures.

When Domain is omitted, the cookie is scoped to the host that set it. Adding Domain=example.test allows it to be sent to eligible subdomains too. Use the broader form only when multiple hosts genuinely share the same application and trust boundary.

Inspect the response without printing real cookie values into logs:

curl -sS -D - -o /dev/null https://app.example.test/login \
  | awk '
      tolower($1) == "set-cookie:" {
        sub(/Set-Cookie: [^;]*/, "Set-Cookie: [value redacted]")
        print
      }
    '

Review the attributes together

  • Secure restricts transmission to secure contexts.
  • HttpOnly prevents JavaScript access through document.cookie; it does not stop the browser from sending the cookie.
  • SameSite influences cross-site requests and must match the application’s navigation or embedding needs.
  • Path controls when a cookie is sent, but it is not an authorization boundary between applications on the same host.

A cookie using SameSite=None also needs Secure in modern browsers. Avoid copying that pair into applications that do not require cross-site use.

Use prefixes when their constraints fit

Cookie name prefixes such as __Secure- and __Host- let supporting browsers enforce additional requirements. A __Host- cookie must use Secure, omit Domain, and use Path=/, which makes the host-only intention explicit.

Test deletion with the same scope

Deleting a cookie requires an expiry directive that matches the attributes used to store it, particularly name, domain, and path. A logout that clears only one variant can leave another cookie active.

A genuinely static documentation site normally has no reason to set application cookies. Verify that the public response contains no Set-Cookie header rather than adding a consent surface for storage the site does not need.

Sources