Set-Cookie parser

Reads a Set-Cookie value as RFC 6265bis does: name, attributes, Secure, HttpOnly, SameSite, Partitioned, the __Host- and __Secure- prefix rules, Domain, Path, Expires and Max-Age with the 400-day cap. The cookie's value is never returned or stored, only its length. Nothing is fetched.

Updated 2026-10-27

What this tool checks

The value is read as RFC 6265bis describes, with the last of a repeated attribute winning:

Transport: Secure, and SameSite=None without Secure, which browsers reject (COOKIE_SAMESITE_NONE_INSECURE).
Scripts: whether HttpOnly hides the cookie from JavaScript.
Prefixes: the rules for __Host- and __Secure- names.
Scope and lifetime: Domain, Path, Expires (in any date form browsers accept) and Max-Age with the 400-day cap.

How to read the result

The result lists the cookie's name, the length of its value and every attribute. A Set-Cookie: header name in front of the value is accepted. Errors mean a browser does not store the cookie at all.

Limitations

One cookie per check: paste each Set-Cookie line on its own. Only the first cookie of a longer paste is read, and nothing of the others is returned (COOKIE_MULTIPLE).
A Domain or Path value or an attribute name with spaces, quotes, commas or equals signs is left out of the result, because it could hold part of a cookie value.
Nothing is fetched, so the tool cannot tell which cookies a site really sets; the security headers check reads them from a live site.

Use it from code

API reference for Set-Cookie parser

curl -i -X POST https://api.lookproof.dev/v1/http/cookie-parse \
  -H 'content-type: application/json' \
  -d '{"header": "Set-Cookie: __Secure-session=3f9a1c7e5b2d; Domain=example.com; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=86400"}'

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Set-Cookie value
Deadline	2 seconds
Freshness	Computed from the input; nothing is looked up
Price	$0.002 per check

Findings this tool can report

Cookies (9)

Error COOKIE_INVALID The Set-Cookie value has no valid name=value pair.
Info COOKIE_LONG_LIFETIME The cookie asks to live longer than the 400 days browsers allow.
Info COOKIE_MULTIPLE The text holds more than one cookie; only the first was checked.
Info COOKIE_NO_HTTPONLY The cookie can be read by scripts (no HttpOnly attribute).
Info COOKIE_NO_SAMESITE The cookie has no SameSite attribute.
Warning COOKIE_NO_SECURE The cookie has no Secure attribute.
Error COOKIE_PREFIX_INVALID The cookie breaks the rules of its __Host- or __Secure- prefix.
Warning COOKIE_SAMESITE_INVALID The SameSite attribute has a value browsers do not know.
Error COOKIE_SAMESITE_NONE_INSECURE SameSite=None without Secure: browsers reject the cookie.

Frequently asked questions

Is the cookie value stored or shown?

No. The value can be a session secret, so the result holds only its length. It is not returned, not put in any finding and not stored with the result. Only the cookie's name and attributes are shown.

What are the __Host- and __Secure- prefixes?

A cookie whose name starts with __Secure- must have Secure. One that starts with __Host- must also have Path=/ and no Domain, which locks it to one host. Browsers reject a cookie that breaks these rules: COOKIE_PREFIX_INVALID.

Why is a cookie without SameSite only information?

Chromium-based browsers treat it as SameSite=Lax, but other browsers send it on every cross-site request. Setting the attribute explicitly gives the same behaviour everywhere, so the tool reports COOKIE_NO_SAMESITE.

How long can a cookie live?

RFC 6265bis caps Expires and Max-Age at 400 days, and current browsers apply the cap. Max-Age wins over Expires when both are set. A longer request is reported as COOKIE_LONG_LIFETIME.