portswigger.net/research· Sep 3, 2025

Cookie Chaos: How to bypass __Host and __Secure cookie prefixes

Open Original Article ↗
Browsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you’ll see how to bypass cookie defenses using discrepancies in browser and serve
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.