OWASPASVS 5.0 requirement

ASVS-V3.3.1 Cookies have the 'secure' attribute set, and if the '\__host-' prefix is not used for the cookie name, the '__secure-' prefix must be used…

L1 Published 2025 Official page ↗
Standard
OWASP ASVS 5.0
Chapter
V3 Web Frontend Security
Section
V3.3 Cookie Setup
Level
L1 (requirement applies from this verification level up)

Requirement

Verify that cookies have the 'Secure' attribute set, and if the '\__Host-' prefix is not used for the cookie name, the '__Secure-' prefix must be used for the cookie name.