Tools / Cookie security
Cookie security checker
Inspect the Set-Cookie attributes returned by a public page. Cookie values are never displayed in the result.
Attributes checked
Securelimits transmission to HTTPS.HttpOnlyprevents access through browser script APIs where appropriate.SameSitecontrols when browsers attach cookies to cross-site requests.__Host-cookie prefix requirements are checked when used.
Only cookies set by one unauthenticated GET are visible. A cookie's correct settings depend on its purpose and the application flow.