Security Tools

Cookie Security Flag Checker

Paste a Set-Cookie header to check whether it sets the Secure, HttpOnly, and SameSite security attributes.

✗ Secure flag set

Without Secure, the cookie can be sent over plain HTTP, exposing it to network interception.

✗ HttpOnly flag set

Without HttpOnly, JavaScript (and any XSS payload) can read this cookie.

✓ SameSite attribute set

SameSite=Strict or Lax is generally recommended unless the cookie genuinely needs to be sent on cross-site requests (SameSite=None), which additionally requires the Secure flag.

How to use this tool

  1. 1Paste your Set-Cookie header value.
  2. 2See which security flags are set or missing.

Frequently asked questions

When would I intentionally leave HttpOnly off?+

Only if client-side JavaScript genuinely needs to read the cookie's value — for a session or auth cookie, that's usually a red flag rather than a legitimate need.

Related tools