Audit a login cookie for its missing security flags

You log into a site with no idea whether the cookie it just set can be stolen by a script on the page.

IntermediateRead 5 minDoing: about twenty-five minutes with two browser windows open6 steps

What you'll have at the end

A short written note on one login cookie, listing which of HttpOnly, Secure, and SameSite it actually has, and what each missing one leaves open.

Before you start

You need

A login flow you're allowed to test, open in a browser with a working network inspector and console: your own project in development, or any site you have explicit permission to test.

Not covered

Changing your own server's cookie settings to add whatever's missing: that job belongs to whichever framework serves the login, and it isn't part of this check.

Leans on

6 steps

Where to go next

Prove your bearer token check works

when the login credential riding along is a bearer token instead of a cookie, and you want the same kind of live proof that a check genuinely rejects and accepts it.

Checked 18 Aug 2026

Part of the HTTP cookbook