Check the cookies a site sets, per redirect hop and in JSON, for missing Secure/HttpOnly/SameSite flags and RFC violations, from CI or a script. Each cookie is reported with its attributes, __Host-/__Secure- prefix rules, lifetime and size, and the response carries coded issues plus an overall grade (A+ to F) and a score out of 100. Checks are based on RFC 6265 and the RFC 6265bis draft (SameSite=None needs Secure, prefix requirements, 400-day lifetime cap, 4096-byte limit) plus common best practices, such as flagging session-like cookie names that lack HttpOnly. The grade and score use our own formula; they describe cookie attributes only and are not a security audit of the site or a check of cookie-consent or privacy-law compliance. Redirects are followed hop by hop (up to 5) and cookies from every hop are analyzed. Full cookie values are never returned: only valueLength and a short masked valuePreview (at most the first 3 characters). A second endpoint parses Set-Cookie header text you paste in, offline, with no outbound request. Results reflect a single anonymous GET from our servers; cookies set by JavaScript, or only after login or consent, are not visible, and sites that block datacenter traffic may time out or show fewer cookies. Results for /v1/analyze are cached for 6 hours per URL; add fresh=1 to bypass the cache. Private-network targets are rejected.
Fetch a URL and analyze every Set-Cookie header across up to 5 redirect hops; returns per-cookie attributes, coded issues, a grade (A+ to F) and a score. Cached 6 hours; fresh=1 bypasses.
Parse Set-Cookie header text you send, offline with no outbound request; returns per-cookie attributes, coded issues, a grade (A+ to F) and a score.
Easiest way: the APIHub CLI. Credits cover x402, no wallet needed.
# install and set up once
npx @apihubio/cli register
npx @apihubio/cli topup 10
# call this service
npx @apihubio/cli call -X GET "https://proxy.apihub.io/set-cookie/v1/analyze?url=https://github.com"Or call the proxy directly (curl / any HTTP client):
curl https://proxy.apihub.io/set-cookie/v1/analyze?url=https://github.com \
-H "Authorization: Bearer ahk_your_key"
# If credits available: charged automatically, returns 200
# Otherwise: returns 402 (pay via @x402/fetch or top up credits)Estimate your monthly cost for Set-Cookie Analyzer.