Cookie Security Audit
Fetch a URL and audit every Set-Cookie it sends: name, and whether Secure, HttpOnly and SameSite are present — the three flags that decide whether a cookie survives transport, XSS and CSRF. Session cookies missing flags are exactly how session hijacking happens.
🔌 Server-side tool
This tool runs on the server (it fetches third-party URLs directly and cannot run in your browser). Use the paid JSON API below — the worked examples show real server-side results and refresh automatically.
Worked examples
This site
GET /api/v1/security/cookie-audit?url=https%3A%2F%2Fagentstoolshub.com
Result: https://agentstoolshub.com/ sets no cookies
A login-heavy site
GET /api/v1/security/cookie-audit?url=https%3A%2F%2Fgithub.com
Result: 3 cookie(s): 1 missing flags — includes session-like names!
Bare domain form
GET /api/v1/security/cookie-audit?url=example.com
Result: https://example.com/ sets no cookies
Machine API (x402)
$0.02 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/cookie-audit?url=https%3A%2F%2Fagentstoolshub.com HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/cookie-audit",
"input": {"url":"https://agentstoolshub.com"},
"result": { "value": 0, "answer": "https://agentstoolshub.com/ sets no cookies" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Parses every Set-Cookie a server sends and checks the three protection flags — Secure (HTTPS-only), HttpOnly (XSS-proof) and SameSite (CSRF-proof) — with session/auth cookie names flagged as priority findings. The concrete answer to 'is this site's session handling safe?' that header dumps don't give you.
Frequently asked questions
Which flag matters most?
For session cookies, all three: HttpOnly stops JavaScript theft (XSS), SameSite stops cross-site sending (CSRF), Secure stops plaintext leakage. A session cookie missing HttpOnly AND Secure is the classic hijack setup.
Why audit with a cold request?
Cookies often differ between first visit and authenticated sessions. A cold GET shows what an anonymous visitor receives — the baseline a security review starts from.