# Cookie Chaos: How to bypass \_\_Host and \_\_Secure cookie prefixes

DevFeed: [Cookie Chaos: How to bypass \_\_Host and \_\_Secure cookie prefixes](<https://devfeed.tech/articles/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes-7672.md>)

Original publisher: [Read original article](<https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes>)

Author: Zakhar Fedotkin

Published: 2025-09-03T14:46:23Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [browsers](<https://devfeed.tech/topics/browsers.md>), [Security](<https://devfeed.tech/topics/security.md>), [browser](<https://devfeed.tech/topics/browser.md>), [ASP.NET](<https://devfeed.tech/topics/aspnet.md>), [Django](<https://devfeed.tech/topics/django.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [browser](<https://devfeed.tech/tags/browser.md>), [browsers](<https://devfeed.tech/tags/browsers.md>), [django](<https://devfeed.tech/tags/django.md>), [frameworks](<https://devfeed.tech/tags/frameworks.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article explains how discrepancies between browser and server-side cookie parsing can bypass the security restrictions of the __Host and __Secure cookie prefixes. It describes UTF-8 and Unicode whitespace techniques, including behavior in Django and ASP.NET, and notes differences in Safari's handling of cookie names.

## Source excerpt

Browsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you'll see how to bypass cookie defenses using discrepancies in browser and serve