The "Doesn't prove" line under each check is the useful part. One extension for check 5: if a subdomain really does need the session, __Secure- is the fallback when __Host- is too strict. The browser still requires Secure and an HTTPS origin, but it allows Domain and Path, so you give up host-only scoping. At that point every subdomain is inside the trust boundary, which makes it worth checking for dangling DNS records on subdomains you no longer run, since a Domain-scoped cookie is sent to all of them.
Thanks, Damiano, that's a useful extension. You're right that __Secure- still requires the Secure attribute and a secure origin but allows Domain, so a cookie scoped to the parent domain is sent to every subdomain and each one becomes part of the trust boundary. Checking for dangling DNS records on subdomains you no longer run is a good addition to that case.
Damiano Bianda
Full-stack developer: Nuxt, Vue, TypeScript, Python. Based in Ticino.
The "Doesn't prove" line under each check is the useful part. One extension for check 5: if a subdomain really does need the session, __Secure- is the fallback when __Host- is too strict. The browser still requires Secure and an HTTPS origin, but it allows Domain and Path, so you give up host-only scoping. At that point every subdomain is inside the trust boundary, which makes it worth checking for dangling DNS records on subdomains you no longer run, since a Domain-scoped cookie is sent to all of them.