All tools

Same-Site Cookie Attribute Checker

Network

Parse a Set-Cookie header and validate its attribute combination: SameSite=None requires Secure, __Host-/__Secure- prefixes have their own required attributes, and a missing Secure or overly long Max-Age gets flagged.

Paste a Set-Cookie header value and it parses the name, value, and every attribute, then checks the combination against the rules real browsers enforce. SameSite=None is rejected outright without Secure, the __Host- and __Secure- name prefixes each carry their own required attributes that are easy to get subtly wrong, and a Max-Age past 400 days gets silently clamped by Chromium-based browsers rather than erroring. It checks the header text you give it, not a live request or response, so it won't catch a cookie that never gets sent because the server forgot the header entirely.

cookieset-cookiesamesitesecurityheaders

How to use Same-Site Cookie Attribute Checker

  • 1.Paste a full Set-Cookie header value, including the name=value pair and any attributes like Secure, HttpOnly, or SameSite.
  • 2.Review the parsed attribute table alongside any issues (rules that will actually break the cookie) and warnings (recommendations worth considering).
  • 3.Fix flagged issues like a missing Secure on SameSite=None, or a __Host- prefixed cookie that sets Domain when it shouldn't.

Frequently asked questions

Does this send a real cookie or hit a live server?
No, it only parses and validates the header text you paste. It never sends a request or sets an actual cookie.
Why does SameSite=None need Secure?
Modern browsers reject any cookie with SameSite=None that doesn't also set Secure, since a cross-site cookie sent over plain HTTP is a real security risk.
What's special about the __Host- and __Secure- prefixes?
They're a browser-enforced convention: __Secure- requires the Secure attribute, and __Host- additionally requires Path=/ and forbids a Domain attribute, which locks the cookie to the exact host that set it.
Why does it flag a very large Max-Age?
Chromium-based browsers cap cookie expiry at 400 days from when it's set and silently shorten anything longer, so a larger Max-Age won't do what it looks like it does.

Use via API, SDK, or MCP

cURL# Free: 1,000 req/day · Pro: 10,000 req/day
curl -X POST https://api.utilix.tech/v1/tools/same-site-cookie-checker \
  -H "Authorization: Bearer utx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"header":"__Host-session=abc123; Secure; Path=/; SameSite=Strict"}'

Get an API key from your dashboard · Full API docs →

Related tools

CSP Header BuilderBuild Content-Security-Policy headers with presets and validationNetworkReferrer-Policy Header BuilderBuild a Referrer-Policy header value from one or more policy tokens with a plain-English explanation of each and warnings for risky choices like unsafe-urlNetworkCache-Control Header BuilderBuild and explain an HTTP Cache-Control response header from directives like max-age, s-maxage, no-store, and immutableNetwork