Cookie Security Auditor

Fetches one public URL and deeply audits its Set-Cookie response headers for security and privacy posture. Checks the Secure, HttpOnly, and SameSite (Lax/Strict/None) flags, __Host- and __Secure- prefix rules, Partitioned (CHIPS) cookies, session vs persistent expiry risk, first-party vs third-party Domain scope, and known tracking-cookie classification (Google Analytics, Meta Pixel, Hotjar, HubSpot, LinkedIn, X, and more). Returns a readiness score, letter grade, per-cookie issues, and actionable recommendations. Built for security teams, devops engineers, frontend platform teams, site migration QA, and agency consultants.

Use cases

• Verify all session and auth cookies carry Secure and HttpOnly after a deploy or CDN cutover.
• Detect SameSite=None without Secure, which browsers silently reject.
• Catch session cookies that lack HttpOnly, exposing them to JavaScript-based XSS theft.
• Audit __Host- and __Secure- prefix compliance for hardened cookie scoping.
• Identify tracking and analytics cookies and review consent gating under GDPR and CCPA.
• Spot long-lived persistent cookies that increase privacy exposure.
• Check whether third-party Domain attributes allow cross-site cookie transmission.
• Evaluate adoption of Partitioned (CHIPS) cookies for privacy isolation in embedded contexts.
• Run scheduled checks on critical origins to catch cookie configuration drift on edge servers.
• Feed structured results into security QA dashboards or CI pipelines.

Input

Field	Type	Description
startUrl	string	Public HTTP or HTTPS URL to audit. URLs with credentials and private network targets are rejected.
timeoutSeconds	integer	Request timeout from 3 to 30 seconds. Defaults to 10.

Output

The actor pushes one dataset item per run.

Field	Type	Description
inputUrl	string	Original URL from input.
normalizedInputUrl	string	Normalized input URL after defaulting the scheme.
finalUrl	string	Final page URL after redirects.
https	boolean	True when the final URL is HTTPS.
ok	boolean	True when the fetch succeeded.
checkedAt	string	ISO timestamp for the audit.
httpStatus	integer or null	HTTP status code from the response.
cookieCount	integer	Number of distinct cookies after deduplication.
cookies	array	Per-cookie analysis objects.
secureCount	integer	Number of cookies with the Secure flag.
httpOnlyCount	integer	Number of cookies with the HttpOnly flag.
sameSiteLaxCount	integer	Number of cookies with SameSite=Lax.
sameSiteStrictCount	integer	Number of cookies with SameSite=Strict.
sameSiteNoneCount	integer	Number of cookies with SameSite=None.
sameSiteUnsetCount	integer	Number of cookies with no SameSite attribute.
partitionedCount	integer	Number of Partitioned (CHIPS) cookies.
hostPrefixedCount	integer	Number of __Host- prefixed cookies.
securePrefixedCount	integer	Number of __Secure- prefixed cookies.
sessionCookieCount	integer	Number of session cookies (no Max-Age or Expires).
persistentCookieCount	integer	Number of persistent cookies.
firstPartyCount	integer	Number of first-party cookies.
thirdPartyCount	integer	Number of third-party cookies (Domain does not match request host).
trackingCookieCount	integer	Number of known tracking or analytics cookies.
trackingCookies	array	List of tracking cookie names.
hasInsecureCookie	boolean	True when at least one cookie lacks the Secure flag.
hasMissingSecure	boolean	True when at least one cookie lacks the Secure flag.
hasMissingHttpOnly	boolean	True when at least one session-like cookie lacks HttpOnly.
hasSameSiteNone	boolean	True when at least one cookie uses SameSite=None.
hasSameSiteUnset	boolean	True when at least one cookie has no SameSite attribute.
hasInvalidPrefix	boolean	True when a __Host- or __Secure- prefix is invalid.
hasTrackingCookie	boolean	True when at least one known tracking cookie is present.
hasLongExpiry	boolean	True when at least one cookie expires beyond 1 year.
score	integer	Cookie security readiness score from 0 to 100.
grade	string	Letter grade from A+ to F.
issues	array	Human-readable issues with severity where applicable.
recommendations	array	Suggested fixes.
error	string or null	Fetch-level error, if the request failed.

Per-cookie fields

Each object in the cookies array contains:

Field	Type	Description
name	string	Cookie name.
value	string	Cookie value.
secure	boolean	Secure flag present.
httpOnly	boolean	HttpOnly flag present.
sameSite	string	lax, strict, none, or unset.
sameSiteRaw	string or null	Raw SameSite attribute value.
domain	string or null	Domain attribute value.
path	string or null	Path attribute value.
maxAge	integer or null	Max-Age in seconds.
expires	string or null	Expires attribute value.
partitioned	boolean	Partitioned (CHIPS) flag present.
prefix	string	__Host-, __Secure-, or none.
prefixValid	boolean	True when prefix rules are satisfied.
prefixIssues	array	List of prefix validation failures.
isSession	boolean	True when no Max-Age or Expires is set.
expirySeconds	integer or null	Calculated expiry in seconds from now.
longExpiry	boolean	True when expiry exceeds 1 year.
tracking	boolean	True when the cookie matches a known tracking pattern.
thirdParty	boolean	True when the Domain attribute does not match the request host.
likelySession	boolean	True when the name suggests a session or auth token.
sameSiteNoneWithoutSecure	boolean	True when SameSite=None is set without Secure.
issues	array	Per-cookie issues with severity and message.

Example input

{
  "startUrl": "https://example.com/",
  "timeoutSeconds": 10
}

Example output

{
  "inputUrl": "https://example.com/",
  "normalizedInputUrl": "https://example.com/",
  "finalUrl": "https://example.com/",
  "https": true,
  "ok": true,
  "checkedAt": "2025-01-01T00:00:00.000Z",
  "httpStatus": 200,
  "cookieCount": 2,
  "cookies": [
    {
      "name": "__Host-session",
      "value": "abc123",
      "secure": true,
      "httpOnly": true,
      "sameSite": "strict",
      "sameSiteRaw": "Strict",
      "domain": null,
      "path": "/",
      "maxAge": 3600,
      "expires": null,
      "partitioned": false,
      "prefix": "__Host-",
      "prefixValid": true,
      "prefixIssues": [],
      "isSession": false,
      "expirySeconds": 3600,
      "longExpiry": false,
      "tracking": false,
      "thirdParty": false,
      "likelySession": true,
      "sameSiteNoneWithoutSecure": false,
      "issues": []
    },
    {
      "name": "_ga",
      "value": "GA1.2.xxx",
      "secure": true,
      "httpOnly": false,
      "sameSite": "lax",
      "sameSiteRaw": "Lax",
      "domain": ".example.com",
      "path": "/",
      "maxAge": 63072000,
      "expires": null,
      "partitioned": false,
      "prefix": "none",
      "prefixValid": true,
      "prefixIssues": [],
      "isSession": false,
      "expirySeconds": 63072000,
      "longExpiry": true,
      "tracking": true,
      "thirdParty": false,
      "likelySession": false,
      "sameSiteNoneWithoutSecure": false,
      "issues": [
        { "severity": "info", "message": "Cookie \"_ga\" is a known tracking/analytics cookie; review consent requirements under GDPR/CCPA." },
        { "severity": "warn", "message": "Cookie \"_ga\" has an expiry exceeding 1 year; long-lived cookies increase privacy exposure." }
      ]
    }
  ],
  "secureCount": 2,
  "httpOnlyCount": 1,
  "sameSiteLaxCount": 1,
  "sameSiteStrictCount": 1,
  "sameSiteNoneCount": 0,
  "sameSiteUnsetCount": 0,
  "partitionedCount": 0,
  "hostPrefixedCount": 1,
  "securePrefixedCount": 0,
  "sessionCookieCount": 0,
  "persistentCookieCount": 2,
  "firstPartyCount": 2,
  "thirdPartyCount": 0,
  "trackingCookieCount": 1,
  "trackingCookies": ["_ga"],
  "hasInsecureCookie": false,
  "hasMissingSecure": false,
  "hasMissingHttpOnly": false,
  "hasSameSiteNone": false,
  "hasSameSiteUnset": false,
  "hasInvalidPrefix": false,
  "hasTrackingCookie": true,
  "hasLongExpiry": true,
  "score": 92,
  "grade": "A",
  "issues": [
    "1 known tracking/analytics cookie(s) detected; review consent requirements under GDPR/CCPA.",
    "One or more cookies have an expiry exceeding 1 year; long-lived cookies increase privacy exposure."
  ],
  "recommendations": [
    "1 known tracking/analytics cookie(s) detected; review consent requirements under GDPR/CCPA.",
    "One or more cookies have an expiry exceeding 1 year; long-lived cookies increase privacy exposure.",
    "Ensure tracking cookies are gated by a consent management platform (CMP) and documented in the privacy policy.",
    "Reduce cookie expiry to the shortest practical lifetime; avoid persisting identifiers beyond 1 year.",
    "Consider adopting Partitioned (CHIPS) cookies for third-party embeds to improve privacy isolation."
  ],
  "error": null
}

Security

• Only public HTTP and HTTPS URLs are fetched.
• URLs with usernames or passwords are rejected.
• Private IPv4, private IPv6, localhost, link-local, and private DNS resolutions are blocked before fetching.
• Redirect destinations are revalidated before they are followed.
• The actor does not require logins, browser sessions, or credentials.
• The actor reads Set-Cookie response headers only; it does not execute JavaScript, render pages, or follow client-side cookie assignment.

Pricing

Event	Suggested price
Actor start	$0.005
URL audited	$0.01

Suggested launch price: about $0.015 per audited URL. Teams can schedule the actor for recurring checks on important origins after deploys and CDN cutovers.

FAQ

Does this actor crawl multiple URLs or a whole site?

No. It fetches one URL per run, collecting Set-Cookie headers across the redirect chain. This keeps runs cheap and predictable for CI and scheduled monitoring.

How does the score work?

The score starts at 100 and is reduced for: missing Secure (-20), missing HttpOnly on session-like cookies (-20), SameSite=None without Secure (-15), SameSite=None with Secure (-10), SameSite unset (-5), invalid prefix (-10), tracking cookies (-3 each, capped at -15), long expiry over 1 year (-5), and third-party Domain (-5). Partitioned (CHIPS) cookies add +3 when no insecure cookies are present. Pages with no Set-Cookie headers receive an A+.

What is the difference between this actor and the HTTP Security Headers Auditor?

The HTTP Security Headers Auditor checks ten security response headers (HSTS, CSP, X-Frame-Options, etc.) and does not inspect Set-Cookie attributes. This Cookie Security Auditor is specialized: it parses every Set-Cookie header, evaluates Secure, HttpOnly, SameSite, cookie prefixes, Partitioned, expiry, scope, and tracking classification, and returns a recommended hardening path for cookies specifically.

Which cookies are classified as tracking cookies?

The actor checks cookie names against a curated list of well-known analytics and tracking cookies, including Google Analytics (_ga, _gid, _gat), Meta Pixel (_fbp, _fbc), Hotjar (_hjid), HubSpot (__hstc), LinkedIn (bcookie, lidc), X/Twitter (personalization_id, guest_id), Microsoft Clarity (_clck), Segment (ajs_user_id), Mixpanel, Amplitude, and others. Consent-management cookies (OneTrust, Cookiebot) are also flagged for review.

What are __Host- and __Secure- prefixes?

Cookie prefixes from RFC 6265bis that enforce tighter rules. __Host- requires the Secure flag, no Domain attribute, and Path=/. __Secure- requires the Secure flag. Browsers reject cookies that declare a prefix without meeting its requirements.

What is a Partitioned (CHIPS) cookie?

The Partitioned attribute (Cookies Having Independent Partitioned State, CHIPS) scopes third-party cookies to the top-level site that embedded them, improving privacy isolation. The actor detects and counts Partitioned cookies as a positive privacy posture signal.