Set-Cookie Header Parser and Checker
Parse a Set-Cookie header and check Secure, HttpOnly, SameSite, the prefixes, and the lifetime.
Set-Cookie
session
eyJhbGciOiJIUzI1NiJ9.e30.abc
- Domain
- host only
- Path
- /
- Lifetime
- 1 hours
- Size
- 36 bytes
No finding. The attributes follow current browser rules.
Set-Cookie
theme
dark
- Domain
- host only
- Path
- /
- Lifetime
- Session. The cookie ends when the browser closes.
- Size
- 10 bytes
- SameSite=None needs Secure. Chrome and Firefox reject this cookie.
- No Secure attribute. The browser also sends this cookie over plain HTTP.
- No HttpOnly attribute. Script can read this cookie, so an XSS bug can steal it. Skip this only when the page must read the value.
Set-Cookie
__Host-csrf
9f2c
- Domain
- example.com
- Path
- /
- Lifetime
- Session. The cookie ends when the browser closes.
- Size
- 16 bytes
- No SameSite attribute. Chrome defaults to Lax, other browsers differ. Set it explicitly.
- No HttpOnly attribute. Script can read this cookie, so an XSS bug can steal it. Skip this only when the page must read the value.
- A __Host- cookie needs Secure, Path=/, and no Domain. The browser rejects it.
About cookie headers
A server sets a cookie with a Set-Cookie response header. The header holds the name, the value, and the attributes that control where the browser sends the cookie and for how long. A browser sends the cookie back in a Cookie request header, with the names and the values only.
Three attributes decide the safety of a cookie. Secure keeps it off plain HTTP. HttpOnly keeps it away from script, so an XSS bug cannot read it. SameSite controls whether another site can make the browser send it. SameSite=None needs Secure, or the browser rejects the cookie.
The __Host- prefix is the strictest form: it needs Secure, Path=/, and no Domain, so a subdomain cannot overwrite it. The tool checks these rules, the 400 day cap that Chrome puts on the lifetime, and the 4096 byte limit that every browser applies.
Paste one header per line. Copy the header from the Network panel of the browser, from a curl response, or from the HTTP Inspector on this site. The parser runs in your browser.