Use the "__Host-" name prefix. [0]

This prevents cookies from being set at the root domain by a subdomain. Which in turn prevents non-TLS MITM cookie injection [1] as long as the application uses HSTS (even without includeSubdomains from the root).

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

[1] https://www.usenix.org/conference/usenixsecurity15/technical...