Make every cookie host-only: __Host- names, Secure, Path=/ #11
2026-11-09
Make the attempt cookie's deletion Secure so a browser honours it
A __Host- cookie is only removed by a Set-Cookie that is itself Secure. The hardening test now checks Secure on every header, deletion included, and the completion tests pin that success and refusal both clear the attempt cookie with Secure, Path=/ and no Domain. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-07
Make every cookie host-only: __Host- names, Secure, Path=/, no Domain
Session, OAuth correlation, antiforgery, voter and Heimdall attempt cookies all take the __Host- prefix. The prefix forbids a narrower Path, so the voter (was /mill) and attempt (was /auth/heimdall) cookies move to Path=/. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>