# Cookie prefix and parsing bypass

Server decodes, trims, or legacy-parses cookie names/values differently than the browser, forging prefixed cookies

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $2,000; latest 2025-09-03. Updated 2026-10-23._

## How it works
Cookie prefixes (`__Host-`, `__Secure-`) are a browser-enforced promise: only the exact origin can set them. The promise breaks when the server and browser disagree about what the cookie name or value boundaries are. Two distinct splits cause this. First, name normalization: the browser stores a name with leading Unicode whitespace or percent-encoding as a different, unrestricted name, but the backend trims or URL-decodes it into the protected name, so a subdomain plants a cookie the server reads as `__Host-`. Second, legacy value parsing: RFC2109 `$Version` handling and quoted values let one cookie string be re-split so neighboring cookies merge into a single value.

## Where it shows up
- Cookie name passed through URL-decode, `.strip()`, or Unicode-whitespace normalization before use [E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes.md)[E3](https://bugbountylibrary.com/r/h1%3A1464396.md)
- Legacy RFC2109 parsing: `$Version=1`, quoted values read to next unescaped quote [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-stealing-httponly-cookies-with-the-cookie-sandwich-technique.md)[E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes.md)
- Cookie values reflected into headers, CORS responses, or tracking endpoints [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-stealing-httponly-cookies-with-the-cookie-sandwich-technique.md)
- Frameworks with lenient defaults (Tomcat, Jetty, Django, ASP.NET, Ruby CGI) [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-stealing-httponly-cookies-with-the-cookie-sandwich-technique.md)[E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes.md)[E3](https://bugbountylibrary.com/r/h1%3A1464396.md)
- Any subdomain with XSS or a reflecting endpoint that can set cookies on the parent domain [E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes.md)

## How to review
Two invariants must hold. (1) Name integrity: the name the server authorizes on must be byte-identical to the name the browser stored, with no decoding or trimming. Check whether the parser unescapes the name (not just the value) and whether it trims Unicode whitespace. (2) Value boundaries: the parser must not honor `$Version` or treat a quoted value as spanning multiple cookies. Concretely, feed a header where a quoted value opens but never closes before the next cookie and confirm the following cookie is not swallowed into the first value. If either check fails, a subdomain can forge a prefixed cookie or swallow an HttpOnly one.

## Variants seen
- Unicode whitespace prefix normalized to `__Host-` by backend trim [E2](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes.md)
- URL-decoded cookie name (`__%48ost-`) colliding with protected name [E3](https://bugbountylibrary.com/r/h1%3A1464396.md)
- `$Version` legacy parsing merging adjacent HttpOnly cookies into a reflected value [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-stealing-httponly-cookies-with-the-cookie-sandwich-technique.md)

## Impact and severity
Led to cookie tossing, session fixation, XSS, and theft of HttpOnly session cookies; one report paid $2,000. Worse when a subdomain XSS or reflecting endpoint exists, and when HttpOnly protections are assumed to hold across a value merge.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-stealing-httponly-cookies-with-the-cookie-sandwich-technique.md
- E2: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes.md
- E3: https://bugbountylibrary.com/r/h1%3A1464396.md