Check the cookies a site sets, per redirect hop and in JSON, for missing Secure/HttpOnly/SameSite flags and RFC violations. Each cookie is reported with its attributes, prefix rules, lifetime and size, plus coded issues, a grade (A+ to F) and a score out of 100. A second endpoint parses Set-Cookie header text you paste in, offline. Full cookie values are never returned.

Hi everyone, this is Set-Cookie Analyzer API. It checks the cookies a site sets, per redirect hop and in JSON, for missing Secure/HttpOnly/SameSite flags and RFC violations, from CI or a script. Each cookie is reported with its attributes, __Host-/__Secure- prefix rules, lifetime and size. The response carries coded issues plus an overall grade (A+ to F) and a score out of 100. Checks are based on RFC 6265 and the RFC 6265bis draft (SameSite=None needs Secure, prefix requirements, 400-day lifetime cap, 4096-byte limit) plus common best practices. The grade and score use our own formula; they describe cookie attributes and are not a security audit of the site or a check of cookie-consent or privacy-law compliance. Two endpoints: - GET /v1/analyze?url= follows redirects hop by hop (up to 5) and analyzes cookies from every hop. Results are cached for 6 hours per URL; fresh=1 bypasses the cache. - POST /v1/parse parses Set-Cookie header text you paste in, offline, with no outbound request. Full cookie values are never returned. The response has valueLength and a short masked valuePreview (up to 3 leading characters). Limits: results reflect a single anonymous GET from our servers. Cookies set by JavaScript, or set after login or consent, are not visible, and sites that block datacenter traffic may time out or show fewer cookies. Private-network targets are rejected. Example: github.com returned 3 cookies, grade A+ (99), measured on 2026-10-12. Where to find it: RapidAPI (public, https://rapidapi.com/tossneon0/a...), APIHub and Zyla. API.Market is in review. Product site: https://set-cookie.glowhalo.org Feedback on the checks and the scoring is welcome.

Set-Cookie Analyzer API

Cookie flag and RFC checks per redirect hop, as JSON

Cookie flag and RFC checks per redirect hop, as JSON