Security Tools

Cookie Analyzer — Secure, HttpOnly & SameSite Flags

Inspect Set-Cookie flags — Secure, HttpOnly, SameSite, Max-Age, Domain, and Path

How to Use This Tool

  1. Enter the HTTPS URL that sets cookies — often a login page or API auth endpoint.
  2. Server fetch follows redirects and captures Set-Cookie headers from the response chain.
  3. Each cookie line splits into name-value pair and attribute flags.
  4. Secure, HttpOnly, and SameSite are detected case-insensitively from attribute tokens.
  5. Max-Age, Domain, Path, and Expires parse when declared on the cookie string.
  6. Review count and per-cookie badges — missing Secure on HTTPS sites and missing HttpOnly on session cookies are priority fixes.

About This Tool

Cookies carry session identifiers and preferences. Misconfigured flags expose sessions to theft via network interception, XSS exfiltration, or cross-site request abuse. VSPIC requests the URL you specify, follows redirects, parses all Set-Cookie headers, and reports each cookie's security attributes in a readable breakdown.

Every cookie shows name plus badges for Secure, HttpOnly, and SameSite values alongside optional Max-Age, Domain, Path, and Expires when present. Use this after login flow changes, OAuth integrations, and compliance audits verifying session cookie hardening on production endpoints.

Common use cases

  • Check if a VPN or proxy is detected on your connection
  • Validate SSL certificates before launch
  • Scan for email addresses in known breaches

Cookie security attributes overview

Secure restricts transmission to HTTPS connections — prevents cleartext Wi-Fi captures. HttpOnly blocks JavaScript document.cookie access — mitigates XSS session theft. SameSite controls cross-site submission — Lax or Strict reduces CSRF class attacks.

Modern browsers default unspecified SameSite to Lax in many cases — explicit Strict is stricter for sensitive sessions.

Set-Cookie parsing behavior

Multiple Set-Cookie headers may appear on one response — each becomes a separate entry. Redirect chains may accumulate cookies from intermediate responses; we parse all captured Set-Cookie lines.

Name and value split on first equals sign; attributes follow semicolon delimiters.

Secure flag expectations

All session cookies on HTTPS-only sites should set Secure. Missing Secure allows network attackers on degraded connections to capture cookie values if HTTPS downgrade occurs.

Our analyzer marks Secure present or absent per cookie with color-coded badges.

HttpOnly and XSS risk

Session identifiers without HttpOnly are readable by any script on the page — including compromised third-party tags. Authentication cookies should always be HttpOnly.

Analytics cookies may intentionally omit HttpOnly for JavaScript access — segment session vs marketing cookies in review.

SameSite policy selection

Strict prevents cookie on all cross-site navigations — strongest CSRF protection but may break OAuth return flows. Lax sends cookies on top-level GET navigations — common default balance.

None requires Secure and allows cross-site embedding contexts — needed for some iframe integrations but increases exposure.

Domain and Path scope

Domain attribute widens cookie scope to subdomains — overly broad Domain=.example.com shares sessions across all subdomains intentionally. Path limits cookie to URL prefix paths.

Review Domain on multi-tenant platforms to prevent accidental cookie leakage across customer subdomains.

Max-Age and Expires lifetime

Session cookies without Max-Age expire when browser closes. Persistent cookies with long Max-Age increase theft window — balance convenience vs risk on remember-me features.

We surface parsed Max-Age and Expires when present for retention policy audits.

Login and OAuth testing workflow

Test POST login endpoint URLs that return Set-Cookie on success. OAuth callbacks often set first-party session — verify flags immediately after code exchange response.

Compare staging vs production — staging sometimes omits Secure on HTTP dev hosts and accidentally ships to prod.

Relationship to JWT and session design

SPAs storing tokens in localStorage bypass HttpOnly protection — prefer HttpOnly cookie sessions when XSS risk exists. JWT in Authorization headers avoids cookie CSRF but shifts XSS exposure to JavaScript storage.

Use JWT decoder on API tokens while cookie analyzer covers browser cookie sessions.

Limitations

HttpOnly cookies set only via JavaScript document.cookie are not Set-Cookie headers — this tool sees server responses only. Subresource responses on the page load without navigating to each URL are not aggregated — test the document or API that sets session.

Some proxies strip or rewrite Set-Cookie — compare with direct origin fetch if results differ from browser devtools.

Frequently Asked Questions

Yes. VSPIC offers this cookie analyzer at no cost with no account required. Results load in real time.

We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.

Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.

The URL may not set cookies without credentials, or cookies require POST login first. Test the endpoint that actually issues Set-Cookie.

Best practice yes. Browsers increasingly enforce Secure for SameSite=None; all auth cookies should set Secure explicitly.

Lax for most apps. Strict for high-security apps without cross-site OAuth. None only when cross-site embedding requires it plus Secure.

Name and parsed attributes appear. Values display in parsed output — avoid testing production secrets on shared screens.

Yes. We follow redirects and parse Set-Cookie from responses in the chain.

It summarizes flags for quick audits. Devtools Application tab remains useful for interactive debugging.

Next step for your check

Continue with ssl/tls grade checker on VSPIC.

SSL/TLS Grade Checker

Trusted by Users Who Value Privacy

Always Free

No premium plan ever

100% Private

Files processed in browser

Instant Results

Convert in seconds

Works Everywhere

Any device, any OS