Set-Cookie Security Checker
Inspect Set-Cookie headers for Secure, HttpOnly, SameSite, prefix rules and other security attributes.
Paste one cookie per line. The checker never sends cookie values to EivoTech.
Audit Set-Cookie headers before deployment
Paste one or more Set-Cookie headers and this tool checks common security attributes and browser rules. The analysis runs in your browser, so the cookie values you paste are not sent to EivoTech.
What it checks
The checker looks at settings such as Secure, HttpOnly, SameSite, Domain and Path handling, cookie prefixes such as __Host- and __Secure-, and modern partitioned-cookie requirements where applicable.
How to use it
- Paste one Set-Cookie header per line.
- Select Check cookie security.
- Review the finding for each cookie.
Why cookie attributes matter
Cookie flags affect when a browser sends a cookie, whether client-side scripts can read it and how it behaves in cross-site situations. Small configuration mistakes can create unnecessary exposure or cause authentication flows to behave differently across browsers.
Do not paste live secrets unless necessary
The processing is local, but it is still good operational practice to replace real session values with dummy text when you only need to inspect the header attributes.