- Cookie prefixes (__Host-, __Secure-) enforce browser restrictions to prevent attacks like cookie tossing or session fixation.
- Browsers send cookies as raw bytes, and server parsing discrepancies can allow attackers to bypass prefix protections.
- Using Unicode whitespace characters (e.g., U+2000) before a cookie name can trick the browser into accepting it as non-restricted, while servers like Django trim the whitespace and treat it as a prefixed cookie.
- Safari blocks multibyte Unicode whitespace but allows single-byte characters like U+0085 or U+00A0.
- Legacy cookie parsing ($Version=1) in Java servers (Tomcat, Jetty) can split a single cookie string into multiple cookies, bypassing prefix checks to inject high-privilege cookies from subdomains.
- An attacker with XSS can inject a forged __Host- cookie using Unicode tricks; when multiple cookies with the same name exist, many frameworks (e.g., Django) take the last value, enabling session fixation or reflected XSS.
- Django considers attacks relying on cookies from untrusted subdomains as not a security vulnerability per their documentation.
- A Burp Suite Custom Action was created to help detect backend vulnerabilities to cookie prefix bypasses.