Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Summary: PortSwigger researcher @zakfedotkin published a proof of concept showing that UTF-8 whitespace characters such as U+2000 can disguise a __Host- prefixed cookie so browsers treat it as unrestricted while servers like Django and ASP.NET trim the character and read it as the protected name. The post also describes a legacy parsing bypass in which a Cookie header beginning with $Version=1 causes Java servers such as Apache Tomcat and Jetty to interpret one cookie string as multiple cookies, allowing a forged __Host- pair to be injected from a subdomain or insecure origin.
Key Takeaway: Django's own response to the report was that the same cookie can be interpreted differently by the browser and the backend, which means the prefix protections your session cookies rely on can be defeated without any flaw in the browser itself. In the demonstrated chain, a reflected cookie value plus last-occurrence-wins parsing in frameworks like Django turns a forged __Host- cookie into cross-site scripting, session fixation, or CSRF bypass.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026