Cookie Security Checker
Ensure your application cookies are secure against theft and CSRF.
Cookie Security Checker
Analyze the HTTP cookies set by a website to see if they follow security best practices (Secure, HttpOnly, SameSite).
Enter a URL above to inspect and validate its HTTP cookies.
Cookie Security Attributes
When a server sends a Set-Cookie header to the browser, it can include several flags that change how the browser handles the cookie. For session identifiers and authentication tokens, these flags are critical.
- Secure: The cookie will only be sent over a secure HTTPS connection. This prevents attackers from sniffing the cookie over unencrypted Wi-Fi networks.
- HttpOnly: The cookie cannot be accessed via client-side JavaScript (e.g.,
document.cookie). This drastically mitigates the risk of Cross-Site Scripting (XSS) attacks stealing session tokens. - SameSite: Controls whether the cookie is sent with cross-site requests.
Strictprevents it from being sent when following links from other sites.Laxallows it for top-level navigations. This mitigates Cross-Site Request Forgery (CSRF).
Related Guides
Deepen your understanding with our expert articles.