Session Cookie Auditor
Review Set-Cookie headers for the flags that most often decide whether session cookies are well defended or quietly exposed.
What the score means
The score is a lightweight hygiene check across Secure, HttpOnly, SameSite, and explicit lifetime controls. It is not a substitute for application-specific threat modeling, but it is a reliable first-pass review.
- Cookies missing Secure or HttpOnly often deserve immediate follow-up.
- SameSite helps, but it should not be treated as your only CSRF defense.
- Explicit lifetime controls reduce ambiguity around how long sessions remain active.
Operational use cases
This works well when reviewing reverse proxy behavior, validating framework defaults, or checking whether staging and production session posture have drifted apart.
- Paste real response headers from browser tools, logs, or gateway captures.
- Use the output to prioritize the highest-risk cookies first.
- Track repeated missing flags as platform-level remediation work.