58

While retrieving a form auth, the browser gets a JSESSIONID cookie shown as host only.

What is a host only cookie?

3 Answers 3

100

First of all, it is not possible for foo.com to set a cookie that can be read by bar.com. Host-only only protects example.com cookies from being read by bar.example.com.

From RFC 6265 regarding setting a cookie and its Domain attribute:

If the domain-attribute is non-empty:

  If the canonicalized request-host does not domain-match the domain-attribute:

    Ignore the cookie entirely and abort these steps.

  Otherwise:

    Set the cookie's host-only-flag to false.

    Set the cookie's domain to the domain-attribute.

Otherwise:

  Set the cookie's host-only-flag to true.

  Set the cookie's domain to the canonicalized request-host.

What this means

The above can be summed up by "Host-only is the default". That is, if Domain is not specified, the cookie can only be read by the exact domain that has set the cookie. This can be loosened by setting the Domain attribute when setting a cookie.

For example, if the cookie is set by www.example.com and the Domain attribute is not specified, the cookie will be set with domain www.example.com and the cookie will be a host only cookie.

Another example: If the cookie is set by www.example.com and the Domain attribute is specified as example.com (so the cookie will be sent to foo.example.com too), the cookie will be set with domain example.com (or possibly .example.com by some browsers that use the dot from the previous RFC 2109 to denote not host-only) and the cookie will not be a host only cookie.

Sending of cookies is covered in section 5.4 regarding the when the cookie header is sent by the browser:

         The cookie's host-only-flag is true and the canonicalized
         request-host is identical to the cookie's domain.
      Or:
         The cookie's host-only-flag is false and the canonicalized
         request-host domain-matches the cookie's domain.

So a cookie with domain example.com and host-only as false is sent to foo.example.com . If host-only is true, the example.com cookie is sent to example.com only.

6
  • 3
    Just ran into this on a client's website and went to look it up. Your comment is clear and understandable. Props for it.
    – spoorlezer
    Mar 31, 2015 at 10:54
  • 1
    Excellent description, thank you. It's worth noting that IE deliberately does not support this (blogs.msdn.microsoft.com/ieinternals/2009/08/20/…) and even latest IE 11 still sends cookies to subdomains even if the domain attribute was set.
    – sparrowt
    Mar 2, 2017 at 15:44
  • 1
    The last sentence is wrong. It should be: "So a cookie with domain example.com and host-only as false is sent to foo.example.com . If host-only is true, the example.com is sent to example.com only." Sep 13, 2020 at 8:09
  • @SkrewEverything Well spotted. The first one to spot my *deliberate mistake in five years! *cough Sep 14, 2020 at 8:16
  • 2
    @sparrowrt this did eventually (after your comment) get fixed in IE and Edge: “By Windows 10 RS4 (April 2018), both Edge and Internet Explorer match other browsers.” (from the FAQ you linked to) Nov 9, 2020 at 9:27
15

Host Only cookie means that the cookie should be handled by the browser to the server only to the same host/server that firstly sent it to the browser.

You don't want to send this host only cookie for ad campaigns, as it might contain sensitive information.

0
1

The cookie's host-only-flag is true and the canonicalized request-host is identical to the cookie's domain.

https://www.rfc-editor.org/rfc/rfc6265#section-5.4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.