Cookie Flags Analyzer

Paste the header and the page checks the five decisions that set a cookie's exposure: Secure, HttpOnly, SameSite, Path and lifetime. Each comes with the concrete effect of being present or absent, rather than a bare right-or-wrong mark — because a session cookie and a preference cookie do not call for the same thing.

The check runs against the real attributes, and that distinction matters more than it seems. Searching for the word secure across the whole header reports the flag present on a cookie merely named secure_token, or whose value contains the word. That is the kind of false positive that gets someone to tick off as fixed a cookie still travelling in the clear.

The page also checks the name prefixes, a little-known contract: a cookie starting with __Secure- is only accepted by the browser if it carries Secure, and one starting with __Host- requires Secure, Path set to slash and no Domain. When the contract is not met, the browser discards the whole Set-Cookie — with no console error, which makes the failure hard to diagnose.