Cookie attribute review
Inspect cookie scope, transport and browser access. Separate what the attributes say from what the server still needs to prove.
Purpose, output & limits Redacted cookie review + verification steps
When introducing or changing session cookies.
Redacted cookie review + verification steps
Cannot establish revocation, CSRF protection or session security.
Processed in this page’s memory. No tool-input uploads, target requests or persistent input storage. Clear or reload to discard this draft. Downloads are saved only when you request them. Keep secrets and confidential records out.
Inspect the cookie boundary.
One response Set-Cookie line per cookie. Values are removed as you enter them; names and attributes remain. Do not paste a request Cookie header.
The purpose assumption applies to all cookies below. Review different purposes separately.
How to obtain the right evidence
In browser developer tools, open Network, select a response and copy its Set-Cookie response headers individually. The JavaScript document.cookie interface does not expose HttpOnly cookies. Use only your own or authorized environments.
A deliberate review.
A usable document.
Paste Set-Cookie lines, set the purpose assumption and run the review. Cookie values are removed.
- Recognized evidence, not a score
- Interpretation with explicit limits
- Next checks and an exportable report
Understand the result.
All technical guides
Session revocation: make logout an enforced event
Closing a screen and clearing a cookie are different from ending access. Define what revocation means across your session store, browser and dependent workflows.
Read articleWhy identity is still the weakest link
A practical look at identity risks in modern infrastructure.
Read article