Django: Cookie Prefix Safety Check
A single pull request addresses a silent cookie failure mode, where Django would set `__Secure-` and `__Host-` prefixed cookies without the attributes browsers actually require, causing those cookies to be dropped without warning.
Duration: PT1M59S
Episode overview
This episode is a short developer briefing from Django.
It explains recent repository work in plain language.
- Show: Django
- Published: 2026-09-11T13:05:38Z
- Audio duration: PT1M59S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's September 11th, and here's your Django briefing.
Today's focus is a quiet but important reliability fix around cookies. There's just one pull request in this cycle, but it addresses a real gap in how Django handles security-sensitive cookie names.
Here's the issue: browsers treat cookie names starting with `__Secure-` or `__Host-` as promises. A `__Secure-` cookie must include the Secure attribute, or the browser rejects it outright. A `__Host-` cookie has even stricter rules — it needs Secure, it can't have a Domain set, and its Path must be root. Until now,…
PR 21955, from contributor GhostCoder6969, changes that by making Django fail fast. Instead of letting a misconfigured cookie disappear downstream in the browser, the framework now catches the problem at the point where the cookie is set. That's a meaningful shift from silent failure to an explicit, early error —…
The change touches response handling and cookie-related code, plus test coverage to lock in the new behavior. It's a focused fix, not a sweeping one, but it's the kind of guardrail that matters more than its size suggests, especially for anyone relying on these security-hardened cookie prefixes for…
W…
Nearby episodes from Django
- When Duplicate Fixes Flood the Queue
- Fixing Old Bugs and Cleaning Up Assumptions
- Test Reliability and Geospatial Cleanup
- Quiet Fixes for Old, Sneaky Bugs
- Weekly Recap - Calendar Versioning Arrives, Query Layer Cleanup Continues
- Spam in the Docs, Substance in the Backend
- Versioning Overhaul and Duplicate Fix Cleanup
- Calendar Versioning Lands, Quiet Correctness Fixes Follow