wtf( )unctionsystem design, drawn
← all problemsCookiesEasy

A name that carries a promise

The session cookie is set at login on www.example.com with Secure, HttpOnly, Path=/ and no Domain. All correct.

The request handler receives Cookie: session=… and has no way to know any of that. The Cookie header carries names and values and nothing else — no flags, no path, no record of which host set it. A cookie planted by something less careful arrives looking exactly the same.

Rename the cookie so the name itself is a claim the browser refuses to carry unless it is true.
Components — tap one, then tap a slot on the diagram
?The server cannot see how a cookie was set. On the way back in, the name is the only thing it can check.

Boundaries, outermost first: www.example.com: Request handler (name and value only), Login endpoint (sets the cookie) Outside every boundary: blog.example.com (a sibling host; FAILED: sets cookies too), an empty slot for the a name only your host can set Connections: Login endpoint calls a name only your host can set — Set-Cookie (step 1) a name only your host can set calls Request handler — back on every request (step 2) blog.example.com must NOT reach a name only your host can set — refused at set time (step 3)

Request handlername and value only
Login endpointsets the cookie
blog.example.coma sibling hostsets cookies too