Set-Cookie parser API
Reads a Set-Cookie value as RFC 6265bis does: name, attributes, Secure, HttpOnly, SameSite, Partitioned, the __Host- and __Secure- prefix rules, Domain, Path, Expires and Max-Age with the 400-day cap. The cookie's value is never returned or stored, only its length. Nothing is fetched.
POST https://api.lookproof.dev/v1/http/cookie-parse
Updated 2026-10-09
Examples use the Base (eip155:8453) network.
Input
A JSON body with content-type: application/json.
| Name | Type | Required | Limits | Description |
|---|---|---|---|---|
header | string | Yes | 1–8192 characters | One Set-Cookie value, at most 8192 characters. The cookie value is never returned or stored, only its length. |
Example request
curl -i -X POST https://api.lookproof.dev/v1/http/cookie-parse \
-H 'content-type: application/json' \
-d '{"header": "Set-Cookie: __Secure-session=3f9a1c7e5b2d; Domain=example.com; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=86400"}'import asyncio
import os
from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact import register_exact_evm_client
async def main() -> None:
signer = EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"]))
client = register_exact_evm_client(x402Client(), signer, networks="eip155:8453")
async with x402HttpxClient(client) as http:
response = await http.post('https://api.lookproof.dev/v1/http/cookie-parse', json={'header': 'Set-Cookie: __Secure-session=3f9a1c7e5b2d; Domain=example.com; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=86400'})
response.raise_for_status()
print(response.json())
asyncio.run(main())
import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";
const account = privateKeyToAccount(process.env.EVM_PRIVATE_KEY);
const fetchWithPayment = wrapFetchWithPaymentFromConfig(fetch, {
schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(account) }],
});
const response = await fetchWithPayment("https://api.lookproof.dev/v1/http/cookie-parse", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({"header": "Set-Cookie: __Secure-session=3f9a1c7e5b2d; Domain=example.com; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=86400"}),
});
console.log(await response.json());
curl: unpaid request — returns 402 with the price (PAYMENT-REQUIRED). The Python and JavaScript clients pay it and send the request again. Only ordinary wallets (EOA) can pay; smart-contract wallets get a 402 without charge. See payments.
Example response
{
"checked_at": "2026-10-24T12:00:00Z",
"data": {
"attributes": [
"domain",
"path",
"secure",
"httponly",
"samesite",
"max-age"
],
"domain": "example.com",
"expires": null,
"header_name": "set-cookie",
"http_only": true,
"lifetime_days": 1,
"max_age": 86400,
"name": "__Secure-session",
"notes": [
"Only the pasted text is read; whether a site sends this header is not checked."
],
"partitioned": false,
"path": "/",
"persistent": true,
"prefix": "__Secure-",
"same_site": "lax",
"secure": true,
"value_length": 12
},
"endpoint": "http.cookie_parse",
"findings": [],
"meta": {
"cache_hit": false,
"duration_ms": 42,
"fresh_until": "2026-10-24T12:05:00Z",
"observed_at": "2026-10-24T12:00:00Z",
"resolver": null,
"source": "offline"
},
"request_id": "req_aaaaaaaaaaaaaaaaaaaaaaaaaa",
"schema_version": "1.0",
"status": "ok"
}
Response fields
| Field | Meaning |
|---|---|
request_id | Unique id of this request. Quote it when you contact support. |
endpoint | The endpoint id, for example mail.spf. |
schema_version | Version of the response format, currently 1.0. |
checked_at | When the check ran (ISO 8601, UTC). |
status | ok, info, warning or error from the worst finding, or unknown when the check was incomplete. unknown is not an error in the domain. |
data | The check's own data. Its fields are listed below. |
findings | What was found: code, severity, message, explanation and evidence. |
meta | Duration, cache use, resolver and how long the result stays fresh. |
Fields in data
| Field | Type |
|---|---|
header_name | string or null |
name | string |
value_length | integer |
prefix | one of __Host-, __Secure- or null |
secure | boolean |
http_only | boolean |
partitioned | boolean |
same_site | one of strict, lax, none, other or null |
domain | string or null |
path | string or null |
expires | string or null |
max_age | integer or null |
persistent | boolean |
lifetime_days | integer or null |
attributes | array of string |
notes | array of string |
Status codes
| Status | Code | Meaning | Do you pay? |
|---|---|---|---|
| 200 | — | The result is delivered, also when it has negative findings. | Yes: charged once per payment; redelivery of the same payment is free |
| 402 | — | Payment is required, or the attached payment was refused. The body states the price. | No |
| 400 | bad_request | The request is malformed. | No |
| 409 | payment_in_progress, payment_bound_to_other_request | This payment is already being processed, or it is bound to a different request. No new payment is taken. | No |
| 413 | payload_too_large | The body is larger than 64 KB. | No |
| 422 | invalid_input | The input failed validation on a request that carries a payment; nothing is charged. Without a payment, invalid input gets a 402 whose error field names the problem. | No |
| 429 | rate_limited | Too many requests from this IP address or payer. | No |
| 502 | check_failed | The check could not be completed. | No |
| 503 | busy, unavailable, payments_unavailable | The service is busy or temporarily unavailable. | No |
| 504 | deadline_exceeded | The check ran out of time. | No |
Errors use the common error body. See errors.
Findings this endpoint can return
Cookies (9)
- Error
COOKIE_INVALIDThe Set-Cookie value has no valid name=value pair. - Info
COOKIE_LONG_LIFETIMEThe cookie asks to live longer than the 400 days browsers allow. - Info
COOKIE_MULTIPLEThe text holds more than one cookie; only the first was checked. - Info
COOKIE_NO_HTTPONLYThe cookie can be read by scripts (no HttpOnly attribute). - Info
COOKIE_NO_SAMESITEThe cookie has no SameSite attribute. - Warning
COOKIE_NO_SECUREThe cookie has no Secure attribute. - Error
COOKIE_PREFIX_INVALIDThe cookie breaks the rules of its __Host- or __Secure- prefix. - Warning
COOKIE_SAMESITE_INVALIDThe SameSite attribute has a value browsers do not know. - Error
COOKIE_SAMESITE_NONE_INSECURESameSite=None without Secure: browsers reject the cookie.