id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37342	set_cookie() should reject __Host- / __Secure- prefixes browsers will silently drop	GhostCoder6969	GhostCoder6969	"Browsers silently ignore a Set-Cookie response when the name uses the __Host- prefix without Secure + Path=/ and no Domain attribute, or the __Secure- prefix without Secure. Django currently accepts such cookies without complaint, so a misconfigured SESSION_COOKIE_NAME / CSRF_COOKIE_NAME (or any set_cookie call) fails open with no signal.

Proposed: raise ValueError from HttpResponse.set_cookie() when the name carries a __Host- / __Secure- prefix whose requirements the cookie attributes don't satisfy.

Reference implementation: GH PR django/django#21955 (will link this ticket there once filed)."	New feature	assigned	HTTP handling	6.1	Normal			GhostCoder6969	Unreviewed	1	0	0	0	0	0