Online Tool Store
Cookie Flag Auditor
Audit a Set-Cookie header or a cookie list for the Secure, HttpOnly and SameSite flags, and see what each missing flag exposes.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Security & Privacy
Cookie Flag Auditor
Frontend preview — no upload or external service.
Audit result
session=abc123: missing Secure, missing HttpOnly, no SameSite. Readable by script, sendable over plain HTTP, and attached to cross-site requests — three separate problems.
How the Cookie Flag Auditor works
- Paste the Set-Cookie header exactly as the server sends it.
- Read each missing flag with what it exposes, rather than treating them as a checklist.
- Set HttpOnly on anything a script never needs to read, which is most session cookies.
FAQ
What does HttpOnly actually prevent?
It stops JavaScript reading the cookie, which means a cross-site scripting flaw cannot simply steal the session token. It does not prevent XSS — it limits what one successful XSS can take.
What should SameSite be set to?
Lax is a sensible default and is what browsers now apply when the attribute is absent. Strict is stronger and breaks links arriving from other sites. None requires Secure and should be deliberate.
Does Secure matter on an HTTPS-only site?
Yes. Without it, a single accidental plain-HTTP request — a mistyped link, an old bookmark — sends the cookie in clear text before any redirect happens.
How we compare
| Feature | Online Tool Store | A command-line tool | A paid audit service |
|---|---|---|---|
| Explains each flag's exposure | ✓ | ✗ | Sometimes |
| Checks all three flags | ✓ | ✓ | ✓ |
| Header stays local | ✓ | ✓ | ✗ |
| Scans a whole site | ✗ | ✗ | ✓ |
Cookie Flag Auditor explains what each missing flag exposes rather than ticking boxes, since HttpOnly and Secure defend against completely different attacks.