🍪 Cookie Analyzer
Inspect all cookies set by a URL and check their security flags - Secure, HttpOnly, SameSite, and more.
Cookie security flags
- Secure - Cookie is only sent over HTTPS connections. Without this flag, the cookie can be intercepted over plain HTTP, even if the user's browser navigates to HTTPS.
- HttpOnly - Cookie cannot be accessed by JavaScript (document.cookie). Protects against XSS attacks stealing session cookies.
- SameSite=Strict - Cookie is only sent on same-site requests. Prevents CSRF attacks completely.
- SameSite=Lax - Cookie is sent on same-site requests and top-level navigations. Good balance between security and usability.
- SameSite=None - Cookie is sent on cross-site requests; requires Secure flag or browsers will reject it.
Session vs persistent cookies
Cookies without an expiry or Max-Age are session cookies - they expire when the browser is closed. Persistent cookies have a set expiry date. For sensitive session tokens, prefer session cookies or short-lived persistent cookies.