Cookie Security Check
Audit Set-Cookie headers for Secure, HttpOnly and SameSite.
What you provide
Result
ISSUE3 findings across 2 cookies
prefs: No Secure attribute, so the cookie is sent over plain HTTP if anything on the site is reachable without TLS. prefs: No HttpOnly attribute, so any script on the page can read it. For a session cookie this is the difference between a cross-site scripting bug and a full account takeover. prefs: No SameSite attribute. Browsers now default to Lax, but relying on a default that has changed once already is worth avoiding.
| Check | Secure | HttpOnly | SameSite | Scoped |
|---|---|---|---|---|
| session | yespass | yespass | laxpass | host onlypass |
| prefs | noissue | noissue | unsetissue | host onlypass |
- Cookies checked
- 2
- Findings
- 3
- session
- Secure, HttpOnly, SameSite=lax
- prefs
- no Secure, no HttpOnly, no SameSite
What this cannot tell you
- Parses the header text you paste, in your browser. It does not fetch any site or read cookies from your browser.
- It checks attributes, not behaviour. A cookie with every flag set can still leak through a redirect, a subdomain takeover or a script that copies its value somewhere else.
Take this with you
How this calculation works
Each header is split into its name, value and attributes, and checked against the flags that decide how exposed the cookie is. The checks go beyond presence: SameSite=None without Secure is rejected outright by browsers, the __Host- prefix imposes three requirements at once, and a leading dot on Domain no longer means what people assume. Each finding says what the browser will actually do rather than just naming a missing attribute.
What the results mean
- HttpOnly
- Stops script reading the cookie. On a session cookie this is what separates a cross-site scripting bug from a full account takeover.
- SameSite
- Controls whether the cookie is sent on cross-site requests. Lax is a sensible default, Strict is stronger and can break links from other sites, None sends it everywhere and requires Secure.
- Scoped
- Whether a Domain attribute widens the cookie to every subdomain. Omitting Domain keeps it on one host, which is almost always what you want.
Common problems and fixes
- A cookie with SameSite=None is not being set at all
- SameSite=None requires the Secure attribute, and browsers reject the combination without it rather than downgrading. Add Secure, and confirm the cookie genuinely needs to work cross-site, because None removes the default protection against cross-site request forgery.
- A __Host- prefixed cookie is silently rejected
- The prefix imposes three conditions together: the Secure attribute, no Domain attribute at all, and Path=/. Fail any one and the browser drops the cookie without an error you will notice. The prefix is worth using on session cookies precisely because the browser enforces the scoping rather than trusting the server.
Frequently asked questions
Which flags does a session cookie need?
Secure, HttpOnly and an explicit SameSite, at minimum. Beyond that, omit Domain so it stays on one host, and consider the __Host- prefix so the browser enforces that. A short lifetime helps as well, since a cookie that expires is one less thing a stolen backup can be used for.
Is SameSite=Strict always better than Lax?
Stronger, and sometimes too strong. Strict means the cookie is not sent when someone follows a link from another site, so a signed-in user arriving from a search result appears signed out. Lax allows it on top-level navigations, which is why it is the browser default and the usual choice for session cookies.
Do these flags protect against everything?
No. They limit how a cookie can be reached, and they do nothing about a server that leaks the value in a URL, a subdomain an attacker controls, or a token that never expires. Treat them as the floor rather than the whole of session security.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/cookie-security-check/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="Cookie Security Check" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/cookie-security-check/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.