Secure Cookie Analyzer
Paste Set-Cookie headers and get a full security analysis of each attribute
Paste one or more Set-Cookie response headers and the analyzer checks each cookie for the attributes that protect sessions from theft and cross-site attacks: Secure, HttpOnly, SameSite, scope and lifetime. Each finding comes with a plain-language explanation and a recommended fix. More free security tools.
A session cookie without the right attributes is exploitable even if the application logic is otherwise sound. Secure stops it being sent over plain HTTP, HttpOnly stops JavaScript (and therefore a successful XSS payload) from reading it, and SameSite controls whether it's sent on cross-site requests — the primary modern defence against CSRF.
This analyzer parses one or more Set-Cookie headers and checks each cookie against those attributes plus scope (Domain and Path, which control how broadly the cookie is shared) and lifetime (a session cookie with no Expires/Max-Age versus a persistent one that outlives the user's intent to stay logged in). Each finding explains the concrete attack it enables and the attribute that closes it.
Need a complete web application security assessment including session management?
If you like this tool, Speak with OneFirewall