Why are HttpOnly cookies not in the page list?

HttpOnly cookies are deliberately hidden from JavaScript, so document.cookie cannot read them — that is the point of the flag. To see them, paste the server's Set-Cookie header into the auditor below.

What does SameSite control?

SameSite governs whether a cookie is sent on cross-site requests. Strict blocks all cross-site sends, Lax allows top-level navigations, and None sends it everywhere — but None requires the Secure flag or browsers reject it.

Why is Secure important?

Without Secure, a cookie is transmitted over plain HTTP and can be intercepted on the network. Any cookie holding a session or auth token should always be marked Secure so it is only sent over HTTPS.

How does this help prevent CSRF?

Setting SameSite=Lax or Strict stops the browser attaching the cookie to forged cross-site requests, which neutralises many CSRF attacks. The auditor warns when a sensitive cookie has SameSite=None or no SameSite at all.

Is anything sent to a server?

No. The tool reads document.cookie and parses pasted headers entirely in JavaScript. Nothing you enter or view leaves your browser.

What is the Cookie Inspector & SameSite Auditor?

Reads the cookies readable from the current page via document.cookie, and audits any pasted Set-Cookie header for Secure, HttpOnly and SameSite flags — flagging missing Secure or improper SameSite that could enable CSRF or cross-site leakage. Runs entirely in your browser. It runs free in your browser on Gera Tools, with nothing uploaded.

Cookie Inspector & SameSite Auditor

Name: Cookie Inspector & SameSite Auditor
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Cookies carry sessions, preferences and tracking identifiers, and their security depends on three flags: Secure, HttpOnly and SameSite. This tool does two things: it lists the cookies the current page can read via document.cookie, and — because the most security-relevant cookies are HttpOnly and invisible to JavaScript — it also parses a pasted Set-Cookie header so you can audit those flags directly without opening network tools.

The two views: page cookies vs. header audit

Page cookie list: document.cookie returns only the non-HttpOnly cookies for the current origin as name=value pairs. Seeing which cookies are readable by JavaScript is itself a privacy signal — if a session token appears in this list, it is also readable by any injected script, which is exactly what HttpOnly is meant to prevent.

Header auditor: The security-critical cookies — session IDs, auth tokens, CSRF tokens — are typically HttpOnly, so they never appear in the page list. To audit them, copy the raw Set-Cookie line from your browser’s network tab or a curl response and paste it here. The parser reads every attribute.

What the auditor checks

The parser splits the header on ; and reads: Secure, HttpOnly, SameSite, Domain, Path, Max-Age and Expires. It then applies three validation rules:

SameSite=None requires Secure, or modern browsers reject the cookie outright — your session will break.
A cookie with a session/auth name (session, sid, token, auth, jwt) should carry both Secure and HttpOnly. Missing either is flagged.
Missing SameSite defaults to Lax in modern browsers but is worth setting explicitly so behaviour does not depend on the browser version.

Worked example

Set-Cookie: sid=abc123; Path=/; SameSite=None

This raises a warning: SameSite=None is set without Secure, so the browser drops the cookie and the session breaks. The correct header is:

Set-Cookie: sid=abc123; Path=/; HttpOnly; Secure; SameSite=Lax

That clears all warnings: the session ID is hidden from scripts, only sent over HTTPS, and restricted from being included on cross-site requests automatically.

Mistake	Risk
Session token readable by JS (no HttpOnly)	Stolen by XSS
Cookie sent over HTTP (no Secure)	Intercepted on the network
SameSite=None without Secure	Rejected by all modern browsers
No SameSite attribute	Browser-dependent behaviour; CSRF exposure in older browsers

Everything runs locally — the auditor inspects only what you paste and makes no network requests.