And the article isn't even about the proliferation of attributes cookies have, that browsers honor, and in some cases are just mandatory. I was trying to explain SameSite to a coworker, and scrolled down a bit... https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#co... wait, cookie prefixes? What the heck are those? The draft appears to date to 2016, but I've been trying to write secure cookie code for longer than that, hadn't heard of it until recently, and I can't really find when they went in to browsers (because there's a lot more drafts than there are implemented drafts and the date doesn't mean much necessarily), replies explaining that welcome.

Seems like every time I look at cookies they've grown a new wrinkle. They're just a nightmare to keep up with.

Well, prefixes are opt-in. You don't have to keep-up with them.

The only recent large problem with cookies were to changes to avoid CSRF, those were opt-out, but they were also extremely overdue.

All of the web standards are always gaining new random features. You don't have to keep-up with most of them. They do look like bad abstractions, but maybe it's just the problem that is hard.

> https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#co... wait, cookie prefixes? What the heck are those?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#co...

> For more information about cookie prefixes and the current state of browser support, see the Prefixes section of the Set-Cookie reference article.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

(Cookie prefixes have been widely supported since 2016 and more or less globally supported since 2019.)

They’re backwards-compatible, so if your cookie need meets the requirements for the `__Host-` prefix, you should use `__Host-`.