Cookie Security Check

Audit Set-Cookie headers for Secure, HttpOnly and SameSite.

What you provide

Result

ISSUE

3 findings across 2 cookies

prefs: No Secure attribute, so the cookie is sent over plain HTTP if anything on the site is reachable without TLS. prefs: No HttpOnly attribute, so any script on the page can read it. For a session cookie this is the difference between a cross-site scripting bug and a full account takeover. prefs: No SameSite attribute. Browsers now default to Lax, but relying on a default that has changed once already is worth avoiding.

Attributes present
CheckSecureHttpOnlySameSiteScoped
sessionyespassyespasslaxpasshost onlypass
prefsnoissuenoissueunsetissuehost onlypass
Diagnostic telemetry
Cookies checked
2
Findings
3
session
Secure, HttpOnly, SameSite=lax
prefs
no Secure, no HttpOnly, no SameSite

What this cannot tell you

  • Parses the header text you paste, in your browser. It does not fetch any site or read cookies from your browser.
  • It checks attributes, not behaviour. A cookie with every flag set can still leak through a redirect, a subdomain takeover or a script that copies its value somewhere else.

Take this with you

Cookie Security Check on RunTheTests — free browser-based websec tools, no sign-up.