WEB / WEB-12.02

Cookie scope, lifetime and flags

Explain cookie inclusion or exclusion on a request using scope, lifetime, channel and site context.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Normal same-host

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

Host-only vs Domain

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://api.library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ×/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: included
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: included
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: included
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

/books ≠ /bookstore

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/bookstore · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ×/×
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

HTTP · Secure excluded

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET http://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ×/×
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

Lax · top-level GET

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

Lax · background POST

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
POST https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ×/× · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

t=1300 · expired

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=1300
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ×/×
Application · request received
No request yet
Request · selection context
Browser clock t=1300
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

None · privacy block

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ×/× · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

Strict · cross-site

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ×/× · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

HttpOnly · script no

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

Script-readable

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: yes/yes
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: included · Domain: included
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: yes/yes

Unrelated host · excluded

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://other.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ×/× · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ✓/✓
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

Credentials omitted

Two alternative cookie configurations
Host-only and Domain=outreason.example are alternative hypothetical configurations, not colliding hd_scope records in one jar. Each is an already accepted stored candidate.
Browser · candidate jar
H: host-only · D: parent Domain
Application · request received
No request yet
Request · selection context
Path=/books · Max-Age=1200
The request context is selected explicitly
The fixture explicitly supplies target, method, top-level navigation and same-site metadata. Same-site is not same-origin; this model does not compute a Public Suffix List or redirect chain.
Browser · candidate jar
Candidate selection pending
Application · request received
No request yet
Request · selection context
GET https://library.outreason.example/books/42 · t=200
Host and slash-path gates
Host-only requires the exact host; a parent Domain can include matching subdomains. /books matches /books/42 but not /bookstore. Path is not authorization or application isolation.
Browser · candidate jar
host H/D ✓/✓ · path H/D ✓/✓
Application · request received
No request yet
Request · selection context
Local scope evaluation
Browser lifetime is calculated separately
Explicit browser model clock: created at t=100, Max-Age=1200; expired at and after t=1300. This selection model does not calculate server session time or revocation.
Browser · candidate jar
lifetime H/D ✓/✓
Application · request received
No request yet
Request · selection context
Browser clock t=200
Channel and script access differ
Secure requires an ordinary HTTPS channel; the labelled HTTP case is not a loopback exception. HttpOnly restricts script API access while eligible requests may still carry the cookie. Script-read here assumes a document at the target context.
Browser · candidate jar
channel H/D ✓/✓
Application · request received
No request yet
Request · selection context
Script read H/D: no/no
Site and browser request-policy gates
Explicit Lax can permit safe cross-site top-level navigation, but not background POST. Strict excludes cross-site requests. None does not override scope, privacy or credentials. These models do not implement prefix, partition or default-Lax compatibility parsing.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
No request yet
Request · selection context
sameSite H/D ✓/✓ · privacy H/D ✓/✓ · credentials H/D ×/×
The HTTP request arrived with selected state
An HTTP request can still occur when a cookie is excluded. Eligibility is shown separately for the alternatives; browser selection is not application permission.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Request received; cookie inclusion separate
Request · selection context
HTTP request arrived
Cookie presence is only an observation
If name/value arrived, the server evaluates it under its own validation and policy. This pure simulation proves neither a real browser jar, successful authentication nor entitlement.
Browser · candidate jar
Host-only: excluded · Domain: excluded
Application · request received
Server validity/authz separate
Request · selection context
Script read H/D: no/no

ACTORS · STATE · DATA FLOW

The cookie is in the jar; why is it missing from the request?

Duru’s Browser shows an hd_scope record for the Atlas library, yet a request to another URL may omit it. Inclusion is not one “cookie exists” question: scope, lifetime, transport, site context and Browser policy are evaluated together.

This lesson makes no application-permission decision. Its goal is explaining whether the Browser includes a candidate record on a request. Included does not mean the server accepts an authenticated session or permits reading a book. WEB-13 sessions and WEB-14 authorization separate those later decisions.

Omitting Domain makes a cookie host-only; setting it broadens scope

A cookie set by library.outreason.example without Domain is host-only: it is a candidate for that host, not automatically for api.library.outreason.example. With Domain=outreason.example, it can be a candidate for that domain and eligible subdomains. A server cannot freely choose an unrelated domain or public suffix.

The artifact compares two separate scope definitions rather than simultaneous same-name cookie collisions. The subdomain case excludes the host-only version and includes the domain-scoped version. This difference follows Browser host matching, not a page path or tenant permission.

Cookie scope is not origin. Origin uses scheme/host/port; cookie domain/path rules are different. Cookies do not isolate ports. Different ports or paths alone do not create separate cookie security areas for applications on the same host.

Path matching is more than guessing a string prefix

A cookie with Path=/books can match /books and /books/42, but not /bookstore. The slash boundary matters. An omitted Path defaults from the URL of the request associated with the response; do not assume it is always /.

The selection limits transmission on requests. It does not create dependable isolation between /admin and /books applications on the same host. UI routing and cookie Path filters do not replace server authorization.

Lifetime describes retention and the Browser session

Max-Age expresses cookie lifetime in seconds; Expires uses a date. Max-Age takes precedence when both are present. Our artifact assumes Browser creation at t=100 with Max-Age=1200 and considers the cookie expired at t=1300. This explicit model clock is not a captured real clock.

A session cookie lacks Max-Age/Expires. The Browser defines the end of its session, and session restore may bring the record back. A persistent cookie has a lifetime but is not guaranteed retention until that deadline: user cleanup, privacy policy or storage eviction may remove it earlier.

Do not equate Browser lifetime with server session expiry. The server can reject a session while its cookie remains, and deleting the jar record does not automatically invalidate a server record. WEB-13.03 develops their separate lifecycles.

Secure and HttpOnly control different things

In ordinary web use, Secure requires HTTPS transport; this excludes the artifact’s HTTP case. Localhost exceptions and Browser compatibility need separate assessment. Secure alone does not protect the value against disk or script access.

HttpOnly restricts script cookie APIs. Eligible fetch or other requests can still include the cookie; the flag does not mean “a request cannot be made.” Restricting script access to a session handle and authorizing an action protect different boundaries.

A supporting Browser requires Secure + Path=/ + no Domain for a __Host- name. The artifact’s /books scope example does not use that prefix, avoiding an invalid combination. Choose prefix compatibility and application-host design together.

Read SameSite with method and navigation context

Same-site evaluation uses scheme and registrable-domain context; it is not equivalent to same-origin. Lax can allow same-site requests. For cross-site requests, explicit Lax also considers top-level navigation and a safe method: a normal GET link navigation differs from a background POST fetch.

Strict limits cross-site inclusion more tightly. None allows cross-site inclusion and requires Secure, but does not remove every other condition or Browser privacy policy. Default behavior and temporary compatibility exceptions can depend on the Browser; our explicit Lax fixture does not assume a default shortcut.

Fetch credentials mode is an additional control. Its same-origin default may omit cookies on a cross-origin fetch, and include does not override SameSite or third-party restrictions. CORS separately evaluates script access to responses. One “cross-domain enabled” switch cannot model all these decisions.

Third-party context adds a policy gate

A library widget embedded on another site can encounter blocked or partitioned third-party state even with SameSite=None; Secure. Without observing application/Browser version, user settings and context, do not claim None works everywhere. The lesson does not treat a vendor roadmap as a Browser guarantee.

In the artifact, a blocked privacy gate produces exclusion despite other eligible gates. That is not evidence of a parser defect or failed authentication. Explain storage acceptance, request inclusion and server validity independently.

Read every scenario without motion

Host scope

Candidate configurations were separated
host-only and domain-scoped are not two concurrent cookies with the same name. The artifact compares alternative configurations; both use Path=/books, Secure and HttpOnly.
Cookie candidates
hd_scope: two separate candidates
Request context
Context not selected
Decision boundary
No inclusion decision
The request context was selected
The selected case targets api.library.outreason.example. GET, now_s=200 and sameSite=true are fixed conditions; this scene explains eligibility without dispatching a request.
Cookie candidates
hd_scope: two separate candidates
Request context
api.library.outreason.example
Decision boundary
No inclusion decision
The matching gate was evaluated
The host-only record applies only to library.outreason.example.
Cookie candidates
host-only=false; domain-scoped=true
Request context
api.library.outreason.example
Decision boundary
No inclusion decision
The eligibility result was separated
Domain scoping expands subdomain eligibility, but does not establish equal trust or shared authorization between applications.
Cookie candidates
host-only=false; domain-scoped=true
Request context
api.library.outreason.example
Decision boundary
host_only_does_not_match_subdomain
Flags do not replace permission
Secure constrains transport eligibility and HttpOnly constrains script access. Neither flag takes over object/action checks for the broader Domain.
Cookie candidates
hd_scope: two separate candidates
Request context
api.library.outreason.example
Decision boundary
Authorization remains separate
The cookie-carriage conclusion was bounded
The artifact provides only the inclusion result host-only=false; domain-scoped=true. Server session acceptance, resource permission and user action intent cannot be inferred from this matrix.
Cookie candidates
host-only=false; domain-scoped=true
Request context
api.library.outreason.example
Decision boundary
Inclusion evidence only

Path boundary

Candidate configurations were separated
host-only and domain-scoped are not two concurrent cookies with the same name. The artifact compares alternative configurations; both use Path=/books, Secure and HttpOnly.
Cookie candidates
hd_scope: two separate candidates
Request context
Context not selected
Decision boundary
No inclusion decision
The request context was selected
The selected case targets /bookstore. GET, now_s=200 and sameSite=true are fixed conditions; this scene explains eligibility without dispatching a request.
Cookie candidates
hd_scope: two separate candidates
Request context
/bookstore
Decision boundary
No inclusion decision
The matching gate was evaluated
Path=/books does not match /bookstore at a slash boundary; a shared text prefix alone is insufficient for path matching.
Cookie candidates
host-only=false; domain-scoped=false
Request context
/bookstore
Decision boundary
No inclusion decision
The eligibility result was separated
Both candidates are excluded for this path. Cookie exclusion does not mean the HTTP request itself cannot be sent.
Cookie candidates
host-only=false; domain-scoped=false
Request context
/bookstore
Decision boundary
slash_path_boundary_not_matched
Flags do not replace permission
Secure constrains transport eligibility and HttpOnly constrains script access. Path selection does not create an independent security boundary between applications on the same host.
Cookie candidates
hd_scope: two separate candidates
Request context
/bookstore
Decision boundary
Authorization remains separate
The cookie-carriage conclusion was bounded
The artifact provides only the inclusion result host-only=false; domain-scoped=false. Server session acceptance, resource permission and user action intent cannot be inferred from this matrix.
Cookie candidates
host-only=false; domain-scoped=false
Request context
/bookstore
Decision boundary
Inclusion evidence only

ASSUMPTION · BOUNDARY · CONTROL

Broader scope also broadens the state-sharing boundary

Domain=outreason.example makes the record eligible for multiple hosts. Sharing a preference can be legitimate, but the relevant assumption concerns the trust level of those hosts’ state use. Expanding scope unnecessarily creates additional sharing when host-only would suffice.

Impact depends on the value and the applications involved. A preference and an authenticated handle have different consequences. Narrow scope, appropriate host separation and server-owned authorization belong in one design; Path=/books alone does not secure sub-applications.

Do not substitute one flag for every control

HttpOnly can hide a value from script APIs without establishing who approved a state-changing action in which context. Secure selects eligible transport without restoring authority to a handle the store must reject.

SameSite affects cross-site cookie inclusion, but passing this gate still leaves object/action permission for the server to evaluate. The broken assumption is that safe cookie carriage implies a safe operation. Keeping control types and boundaries separate prevents that misplaced authority.

Read every scenario without motion

Lifetime boundary

An excluded case was selected
Review starts with matrix row lifetime-boundary. Both candidates are expected to be excluded; no actual browser exclusion record has yet been supplied.
Matrix record
case=lifetime-boundary
Gate review
Gates not compared
Evidence conclusion
No browser observation
The reason field was examined
With createdAt_s=100 and maxAge_s=1200, expiry is 1300. now_s=1300 reaches that boundary exactly; equality is excluded.
Matrix record
case=lifetime-boundary
Gate review
max_age_boundary_reached
Evidence conclusion
No browser observation
Other gates were kept distinct
The target is HTTPS at /books/42, so this row’s lifetime reason is not relabelled as a Secure or Path error.
Matrix record
case=lifetime-boundary
Gate review
Expected exclusion explained
Evidence conclusion
No browser observation
The XPath scope was preserved
The included=false predicate selects 11 excluded decisions in the model. This count spans two configurations and multiple cases; it does not show that 11 actual browser failures occurred.
Matrix record
case=lifetime-boundary
Gate review
Model total: 11 excluded
Evidence conclusion
No browser observation
Actual inclusion evidence was separated
The matrix reason is an expected model outcome. Without the actual request Cookie field, credentials mode and browser exclusion reason, observed inclusion remains undecided.
Matrix record
case=lifetime-boundary
Gate review
max_age_boundary_reached
Evidence conclusion
Observed inclusion unknown
A benign exclusion conclusion was recorded
The expected exclusion reason can be explained for this case. Absence does not establish an attack, failed login or server authorization denial; those require their own evidence.
Matrix record
case=lifetime-boundary
Gate review
Expected result: excluded
Evidence conclusion
Browser outcome needs separate evidence

Privacy block

An excluded case was selected
Review starts with matrix row privacy-blocked-none. Both candidates are expected to be excluded; no actual browser exclusion record has yet been supplied.
Matrix record
case=privacy-blocked-none
Gate review
Gates not compared
Evidence conclusion
No browser observation
The reason field was examined
This alternative configuration uses SameSite=None, but browserPolicyAllowed=false remains. None does not override a third-party restriction.
Matrix record
case=privacy-blocked-none
Gate review
none_does_not_override_third_party_blocking
Evidence conclusion
No browser observation
Other gates were kept distinct
The privacy reason is not explained as if Lax applied. The override belongs only to this alternative case; other configurations have not changed.
Matrix record
case=privacy-blocked-none
Gate review
Expected exclusion explained
Evidence conclusion
No browser observation
The XPath scope was preserved
The included=false predicate selects 11 excluded decisions in the model. This count spans two configurations and multiple cases; it does not show that 11 actual browser failures occurred.
Matrix record
case=privacy-blocked-none
Gate review
Model total: 11 excluded
Evidence conclusion
No browser observation
Actual inclusion evidence was separated
The matrix reason is an expected model outcome. Without the actual request Cookie field, credentials mode and browser exclusion reason, observed inclusion remains undecided.
Matrix record
case=privacy-blocked-none
Gate review
none_does_not_override_third_party_blocking
Evidence conclusion
Observed inclusion unknown
A benign exclusion conclusion was recorded
The expected exclusion reason can be explained for this case. Absence does not establish an attack, failed login or server authorization denial; those require their own evidence.
Matrix record
case=privacy-blocked-none
Gate review
Expected result: excluded
Evidence conclusion
Browser outcome needs separate evidence

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Observe inclusion one condition at a time

Compare Domain/host-only, Path, expiry and flags in cookie storage with the target URL and request context. If Network omits a cookie, inspect Browser exclusion reasons and method/navigation first. A cookie name or server status alone cannot explain the omission.

Our gate matrix separates hostMatch, pathMatch, secureChannel, lifetimeValid, sameSiteEligible and browserPolicyAllowed. These are teaching-model explanation fields, not standard fields automatically available in application logs. We do not claim to emulate every Browser privacy or partition algorithm.

Simple selection and missing evidence

XPath /cookieDecisions/decision[@included="false"] selects the model’s excluded cases. Expected benign results include host-only subdomain mismatch, path mismatch, an insecure channel and cross-site POST under Lax. Calling the selected rows attacks would be incorrect.

An expected inclusion missing from a real Browser can reflect additional privacy settings, credentials mode or an incomplete trace. Record limited observations such as name/scope class and requestId rather than deriving user or tenant from cookies. Preserve decision reasons without copying sensitive cookie values into general logs.

Validate policy changes together with compatibility

Narrowing scope or changing SameSite can affect login redirects, embedded widgets and subdomain flows. Inventory which flows are cross-site, cross-origin or same-host. Observe both expected inclusion and expected exclusion with a small user group.

Validation cannot stop at a visible Browser cookie: server session validity and resource policy need their own evidence. Keep matrix reasons visible when motion is disabled, and do not use color alone to convey included/excluded.

For a session-credential cookie, omit Domain to select host-only scope when cross-subdomain sharing is unnecessary. Use Secure and HttpOnly in an HTTPS application; choose SameSite explicitly with login callbacks and embedding requirements in mind. Lax and Strict differ for navigation; a required cross-site flow using None also requires Secure, and Browser privacy policy can still block transmission. Do not treat Path as a tenant-authorization boundary or HttpOnly as a flag preventing requests. Verify eligible inclusion and expected exclusion in separate example flows, followed by the server session/resource decision.

NOW APPLY IT TO THE CASE

Which permission does scope eligibility not prove?

host-only and domain-scoped are separate configurations for hd_scope. Review separates scope, expiry and privacy gates from server permission.

Which owner holds the case’s browser data? Explain why presence or deletion of a client value differs from the server-side session outcome.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Eight request contexts and two cookie scopes

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "classification": "Separate hypothetical candidate configurations, not concurrent same-name records",
  "cookies": [
    {
      "id": "host-only",
      "name": "hd_scope",
      "setByHost": "library.outreason.example",
      "path": "/books",
      "secure": true,
      "httpOnly": true,
      "sameSite": "Lax",
      "createdAt_s": 100,
      "maxAge_s": 1200,
      "hostOnly": true,
      "domain": "library.outreason.example"
    },
    {
      "id": "domain-scoped",
      "name": "hd_scope",
      "setByHost": "library.outreason.example",
      "path": "/books",
      "secure": true,
      "httpOnly": true,
      "sameSite": "Lax",
      "createdAt_s": 100,
      "maxAge_s": 1200,
      "hostOnly": false,
      "domain": "outreason.example"
    }
  ],
  "cases": [
    {
      "id": "same-host",
      "target": "https://library.outreason.example/books/42",
      "method": "GET",
      "sameSite": true,
      "topLevelNavigation": true,
      "now_s": 200,
      "expected": {
        "host-only": true,
        "domain-scoped": true
      },
      "reason": "all_selected_gates_pass"
    },
    {
      "id": "subdomain",
      "target": "https://api.library.outreason.example/books/42",
      "method": "GET",
      "sameSite": true,
      "topLevelNavigation": true,
      "now_s": 200,
      "expected": {
        "host-only": false,
        "domain-scoped": true
      },
      "reason": "host_only_does_not_match_subdomain"
    },
    {
      "id": "path-boundary",
      "target": "https://library.outreason.example/bookstore",
      "method": "GET",
      "sameSite": true,
      "topLevelNavigation": true,
      "now_s": 200,
      "expected": {
        "host-only": false,
        "domain-scoped": false
      },
      "reason": "slash_path_boundary_not_matched"
    },
    {
      "id": "insecure",
      "target": "http://library.outreason.example/books/42",
      "method": "GET",
      "sameSite": true,
      "topLevelNavigation": true,
      "now_s": 200,
      "expected": {
        "host-only": false,
        "domain-scoped": false
      },
      "reason": "secure_cookie_requires_secure_channel"
    },
    {
      "id": "cross-site-navigation",
      "target": "https://library.outreason.example/books/42",
      "method": "GET",
      "sameSite": false,
      "topLevelNavigation": true,
      "now_s": 200,
      "expected": {
        "host-only": true,
        "domain-scoped": true
      },
      "reason": "explicit_lax_top_level_safe_navigation"
    },
    {
      "id": "cross-site-background",
      "target": "https://library.outreason.example/books/42",
      "method": "POST",
      "sameSite": false,
      "topLevelNavigation": false,
      "now_s": 200,
      "expected": {
        "host-only": false,
        "domain-scoped": false
      },
      "reason": "explicit_lax_cross_site_background_not_eligible"
    },
    {
      "id": "lifetime-boundary",
      "target": "https://library.outreason.example/books/42",
      "method": "GET",
      "sameSite": true,
      "topLevelNavigation": true,
      "now_s": 1300,
      "expected": {
        "host-only": false,
        "domain-scoped": false
      },
      "reason": "max_age_boundary_reached"
    },
    {
      "id": "privacy-blocked-none",
      "target": "https://library.outreason.example/books/42",
      "method": "GET",
      "sameSite": false,
      "topLevelNavigation": false,
      "now_s": 200,
      "cookieOverrides": {
        "sameSite": "None"
      },
      "browserPolicyAllowed": false,
      "expected": {
        "host-only": false,
        "domain-scoped": false
      },
      "reason": "none_does_not_override_third_party_blocking"
    }
  ],
  "assumptions": [
    "Explicit Lax, HTTPS except labelled insecure case, ordinary web context without localhost exception.",
    "Third-party policy allows inclusion unless explicitly blocked; cookies already stored.",
    "No redirect-chain, partition-key, Browser-specific default-Lax exception or prefix parser implementation.",
    "None override is an alternative configuration for one labelled case, not a dynamic header modification."
  ],
  "decisionXML": "<cookieDecisions><decision case=\"same-host\" cookie=\"host-only\" included=\"true\"/><decision case=\"same-host\" cookie=\"domain-scoped\" included=\"true\"/><decision case=\"subdomain\" cookie=\"host-only\" included=\"false\"/><decision case=\"subdomain\" cookie=\"domain-scoped\" included=\"true\"/><decision case=\"path-boundary\" cookie=\"host-only\" included=\"false\"/><decision case=\"path-boundary\" cookie=\"domain-scoped\" included=\"false\"/><decision case=\"insecure\" cookie=\"host-only\" included=\"false\"/><decision case=\"insecure\" cookie=\"domain-scoped\" included=\"false\"/><decision case=\"cross-site-navigation\" cookie=\"host-only\" included=\"true\"/><decision case=\"cross-site-navigation\" cookie=\"domain-scoped\" included=\"true\"/><decision case=\"cross-site-background\" cookie=\"host-only\" included=\"false\"/><decision case=\"cross-site-background\" cookie=\"domain-scoped\" included=\"false\"/><decision case=\"lifetime-boundary\" cookie=\"host-only\" included=\"false\"/><decision case=\"lifetime-boundary\" cookie=\"domain-scoped\" included=\"false\"/><decision case=\"privacy-blocked-none\" cookie=\"host-only\" included=\"false\"/><decision case=\"privacy-blocked-none\" cookie=\"domain-scoped\" included=\"false\"/></cookieDecisions>",
  "localXPath": "/cookieDecisions/decision[@included=\"false\"]",
  "expectedExcludedDecisions": 11
}

hostOnly / domain: Only the setter host versus domain-plus-subdomain eligibility.
path: Request-path filtering with slash boundaries, not security isolation.
createdAt_s / maxAge_s / now_s: Explicit Browser-lifetime calculation, not a server session timeout.
secure / httpOnly: Separate transport and script access; HttpOnly does not automatically block inclusion.
sameSite / topLevelNavigation / method: Context for explicit-Lax inclusion. sameSite is supplied input, not a PSL algorithm output.
browserPolicyAllowed: Selected third-party privacy gate, not overridden by None.
expected / decisionXML: Benign include/exclude outcomes and the inert local-XPath schema.

The matrix is not a complete Browser. Cookie records are alternative configurations rather than a capture. It explains Path, Secure, lifetime, explicit Lax and a supplied privacy gate; redirects, CORS response access, partitioning and storage acceptance remain outside this scope.

Two reality checks

Cookie Path=/books securely isolates state from /admin on the same host.

Path filters request transmission; it is not dependable same-host isolation or a substitute for server authorization.

SameSite=None; Secure guarantees transmission on every third-party request.

None affects the SameSite gate only. Browser privacy/partition policy, scope, lifetime and credentials conditions still apply.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

Is a Path=/books cookie eligible for /bookstore?

No; the selected slash path boundary does not match.
Yes; starting the path string with /books is sufficient.

Read the explained answer

No; the selected slash path boundary does not match. — The paths share a string prefix, but there is no slash after /books; expected inclusion is false.

Why is only the domain-scoped candidate eligible for the subdomain request?

Selected lesson artifact fields; teaching example

cookies[0].hostOnly: true
cookies[1].domain: outreason.example
cases[1]: {"id":"subdomain","target":"https://api.library.outreason.example/books/42","method":"GET","sameSite":true,"topLevelNavigation":true,"now_s":200,"expected":{"host-only":false,"domain-scoped":true},"reason":"host_only_does_not_match_subdomain"}

HttpOnly expands subdomain scope for every candidate.
Host-only requires the exact host; the domain-scoped candidate includes the selected subdomain.

Read the explained answer

Host-only requires the exact host; the domain-scoped candidate includes the selected subdomain. — api.library.outreason.example is not host-only library.outreason.example; domain outreason.example matches.

Why is the alternative SameSite=None+Secure configuration still withheld in the privacy-blocked branch? Do Secure/HttpOnly authorize the user?

Read the explained answer

Selecting None does not override third-party privacy policy; browserPolicyAllowed=false closes inclusion. Secure is a channel condition, while HttpOnly limits script exposure. Sending a Cookie does not prove a valid server session or allowed resource permission; those checks remain separate.

□ I did not treat None as a browser-privacy override.

□ I did not count Cookie flags as server authorization.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

RFC 6265 — HTTP State Management Mechanism4.1.2.1 Expires · 4.1.2.2 Max-Age · 4.1.2.3 Domain · 4.1.2.4 Path · 4.1.2.5 Secure · 4.1.2.6 HttpOnly · 5.1.4 Paths and Path-Match · 5.4 Cookie header · 8.5 Weak Confidentiality: ports
MDN — Set-Cookie headerAttributes: Domain, Expires, HttpOnly, Max-Age, Path, SameSite, Secure · Cookie prefixes
MDN — Using HTTP cookiesCreating, removing, and updating cookies · Define where cookies are sent
WHATWG — Fetch Standard2.2.5 Requests: credentials mode · 3.3.5 CORS protocol and credentials
MDN — Third-party cookiesHow do browsers handle third-party cookies? · Limiting third-party cookies with SameSite

YOUR NOTES / THIS BROWSER

Cookie scope, lifetime and flags

1. Core · Mechanism

Normal same-host

Host-only vs Domain

/books ≠ /bookstore

HTTP · Secure excluded

Lax · top-level GET

Lax · background POST

t=1300 · expired

None · privacy block

Strict · cross-site

HttpOnly · script no

Script-readable

Unrelated host · excluded

Credentials omitted

The cookie is in the jar; why is it missing from the request?

Omitting Domain makes a cookie host-only; setting it broadens scope

Path matching is more than guessing a string prefix

Lifetime describes retention and the Browser session

Secure and HttpOnly control different things

Read SameSite with method and navigation context

Third-party context adds a policy gate

2. Red · Trust & Impact

Host scope

Path boundary

Broader scope also broadens the state-sharing boundary

Do not substitute one flag for every control

3. Blue · Secure development & defense

Lifetime boundary

Privacy block

Observe inclusion one condition at a time

Simple selection and missing evidence

Validate policy changes together with compatibility

Which permission does scope eligibility not prove?

Two reality checks

Is a Path=/books cookie eligible for /bookstore?

Why is only the domain-scoped candidate eligible for the subdomain request?

Why is the alternative SameSite=None+Secure configuration still withheld in the privacy-blocked branch? Do Secure/HttpOnly authorize the user?

Sources and scope