Cookie Analyzer — Secure, HttpOnly & SameSite Flags
Inspect Set-Cookie flags — Secure, HttpOnly, SameSite, Max-Age, Domain, and Path
How to Use This Tool
- Enter the HTTPS URL that sets cookies — often a login page or API auth endpoint.
- Server fetch follows redirects and captures Set-Cookie headers from the response chain.
- Each cookie line splits into name-value pair and attribute flags.
- Secure, HttpOnly, and SameSite are detected case-insensitively from attribute tokens.
- Max-Age, Domain, Path, and Expires parse when declared on the cookie string.
- Review count and per-cookie badges — missing Secure on HTTPS sites and missing HttpOnly on session cookies are priority fixes.
About This Tool
Cookies carry session identifiers and preferences. Misconfigured flags expose sessions to theft via network interception, XSS exfiltration, or cross-site request abuse. VSPIC requests the URL you specify, follows redirects, parses all Set-Cookie headers, and reports each cookie's security attributes in a readable breakdown.
Every cookie shows name plus badges for Secure, HttpOnly, and SameSite values alongside optional Max-Age, Domain, Path, and Expires when present. Use this after login flow changes, OAuth integrations, and compliance audits verifying session cookie hardening on production endpoints.
Common use cases
- •Check if a VPN or proxy is detected on your connection
- •Validate SSL certificates before launch
- •Scan for email addresses in known breaches
Cookie security attributes overview
Secure restricts transmission to HTTPS connections — prevents cleartext Wi-Fi captures. HttpOnly blocks JavaScript document.cookie access — mitigates XSS session theft. SameSite controls cross-site submission — Lax or Strict reduces CSRF class attacks.
Modern browsers default unspecified SameSite to Lax in many cases — explicit Strict is stricter for sensitive sessions.
Set-Cookie parsing behavior
Multiple Set-Cookie headers may appear on one response — each becomes a separate entry. Redirect chains may accumulate cookies from intermediate responses; we parse all captured Set-Cookie lines.
Name and value split on first equals sign; attributes follow semicolon delimiters.
Secure flag expectations
All session cookies on HTTPS-only sites should set Secure. Missing Secure allows network attackers on degraded connections to capture cookie values if HTTPS downgrade occurs.
Our analyzer marks Secure present or absent per cookie with color-coded badges.
HttpOnly and XSS risk
Session identifiers without HttpOnly are readable by any script on the page — including compromised third-party tags. Authentication cookies should always be HttpOnly.
Analytics cookies may intentionally omit HttpOnly for JavaScript access — segment session vs marketing cookies in review.
SameSite policy selection
Strict prevents cookie on all cross-site navigations — strongest CSRF protection but may break OAuth return flows. Lax sends cookies on top-level GET navigations — common default balance.
None requires Secure and allows cross-site embedding contexts — needed for some iframe integrations but increases exposure.
Domain and Path scope
Domain attribute widens cookie scope to subdomains — overly broad Domain=.example.com shares sessions across all subdomains intentionally. Path limits cookie to URL prefix paths.
Review Domain on multi-tenant platforms to prevent accidental cookie leakage across customer subdomains.
Max-Age and Expires lifetime
Session cookies without Max-Age expire when browser closes. Persistent cookies with long Max-Age increase theft window — balance convenience vs risk on remember-me features.
We surface parsed Max-Age and Expires when present for retention policy audits.
Login and OAuth testing workflow
Test POST login endpoint URLs that return Set-Cookie on success. OAuth callbacks often set first-party session — verify flags immediately after code exchange response.
Compare staging vs production — staging sometimes omits Secure on HTTP dev hosts and accidentally ships to prod.
Relationship to JWT and session design
SPAs storing tokens in localStorage bypass HttpOnly protection — prefer HttpOnly cookie sessions when XSS risk exists. JWT in Authorization headers avoids cookie CSRF but shifts XSS exposure to JavaScript storage.
Use JWT decoder on API tokens while cookie analyzer covers browser cookie sessions.
Limitations
HttpOnly cookies set only via JavaScript document.cookie are not Set-Cookie headers — this tool sees server responses only. Subresource responses on the page load without navigating to each URL are not aggregated — test the document or API that sets session.
Some proxies strip or rewrite Set-Cookie — compare with direct origin fetch if results differ from browser devtools.
Frequently Asked Questions
Yes. VSPIC offers this cookie analyzer at no cost with no account required. Results load in real time.
We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.
Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.
The URL may not set cookies without credentials, or cookies require POST login first. Test the endpoint that actually issues Set-Cookie.
Best practice yes. Browsers increasingly enforce Secure for SameSite=None; all auth cookies should set Secure explicitly.
Lax for most apps. Strict for high-security apps without cross-site OAuth. None only when cross-site embedding requires it plus Secure.
Name and parsed attributes appear. Values display in parsed output — avoid testing production secrets on shared screens.
Yes. We follow redirects and parse Set-Cookie from responses in the chain.
It summarizes flags for quick audits. Devtools Application tab remains useful for interactive debugging.
Next step for your check
Continue with ssl/tls grade checker on VSPIC.
Related Tools
Explore more free VSPIC tools for IP, DNS, security, and network diagnostics.
SSL/TLS Grade Checker
SSL grade, protocol support, cipher analysis, and expiry
Use Free →Security Headers Checker
HSTS, CSP grade A–F, per-header score, full header map
Use Free →CORS Checker
Check allowed origins, methods, and headers
Use Free →Clickjacking Test
Detect iframe embedding and X-Frame-Options status
Use Free →Mixed Content Checker
Find HTTP resources on HTTPS pages
Use Free →Malware URL Scanner
URL reputation scan — single or batch, phishing & malware signals
Use Free →SSL Checker
Validate SSL/TLS certificates and expiration dates
Use Free →
Trusted by Users Who Value Privacy
Always Free
No premium plan ever
100% Private
Files processed in browser
Instant Results
Convert in seconds
Works Everywhere
Any device, any OS