Web Cookie Security Auditor

Audit Set-Cookie headers on public websites for Secure, HttpOnly, SameSite, scope and session-cookie hygiene with one structured result per URL.

Why use this Actor

Web teams need recurring evidence that authentication and state cookies remain hardened across application, CDN and framework changes.

Key features

• Buyer-native inputs aligned to cookie security.
• Predictable structured output in the default Apify Dataset.
• Pay Per Event pricing tied to measurable result rows or reports.
• Optional MCP connector delivery for downstream automation and AI agents.

Quick start

Start with this working example and replace the target values with your own:

{
  "urls": [
    "https://example.com"
  ]
}

The Actor writes structured results to the default Apify Dataset and can be used from the Store, API, schedules, Tasks, automations and MCP-compatible AI workflows.

Input

• urls — URLs: Configure URLs for this Actor run.
• previousSnapshots — Previous cookie snapshots: Configure Previous cookie snapshots for this Actor run.
• failRunOnRisk — Fail on cookie security risk: Configure Fail on cookie security risk for this Actor run.
• maxUrls — Maximum URLs: Configure Maximum URLs for this Actor run.
• concurrency — Concurrency: Maximum URLs audited in parallel.

All integration and advanced analysis fields are optional. The default example is intentionally runnable without configuring MCP or a previous-run baseline.

Output

The Dataset exposes predictable machine-readable output. Representative fields include dataset.

Pricing

This Actor uses Pay Per Event. The current factory base price is $0.001200 per result event. The Apify Store remains the source of truth for the price and plan/tier details shown to the buyer.

Use cases

• Run the buyer-ready workflows exposed as Apify Tasks without preparing a custom integration first.
• Use the Actor from API or schedules for recurring collection, comparison or monitoring.
• Feed the structured Dataset output into spreadsheets, databases, automations or AI agents.
• Compare repeat runs when the product supports snapshots or previous-run inputs.

Automation and AI

Use the same Actor through Apify API, schedules, public Tasks and the Apify MCP server. Outputs are structured for downstream workflows and AI agents rather than requiring manual copy/paste.

Limitations

• Public websites and upstream APIs can change markup, access rules, rate limits or field availability without notice.
• Fields that are not publicly available are returned as unavailable or omitted rather than fabricated.
• Analytical outputs depend on the quality and coverage of the supplied or collected source data.
• Treat marketplace, reputation, workforce, safety or commercial signals as decision support and validate material decisions against the underlying source evidence.

Detailed documentation

Detailed documentation

Audit public Set-Cookie behavior for browser hardening, release QA, and recurring configuration regressions.

Why use this Actor

Cookie behavior changes when application frameworks, reverse proxies, CDNs, authentication systems, and consent layers change. A single missing Secure or HttpOnly flag can matter more than a long generic security report, while modern browser attributes such as SameSite, cookie prefixes, and Partitioned cookies introduce additional failure modes. This Actor converts observable Set-Cookie headers into per-cookie evidence, an aggregate security score, and a reusable snapshot that can be compared across releases.

Key features

• Evaluates Secure, HttpOnly, and SameSite on every observed Set-Cookie header.
• Detects SameSite=None without Secure.
• Validates __Secure- and __Host- prefix requirements.
• Detects Partitioned/CHIPS cookies and flags insecure combinations.
• Reports Domain, Path, Max-Age, and very long-lived persistence risks.
• Produces per-cookie issue lists instead of only page-level booleans.
• Generates a normalized cookie snapshot and fingerprint.
• Compares optional previous snapshots and identifies cookie-set drift.
• Supports a fail-after-evidence security gate for automated QA.

Input

Provide urls. Add previousSnapshots to compare current public cookie configuration with an earlier run. Set failRunOnRisk for CI/CD or monitoring workflows that should fail after evidence is stored. maxUrls limits batch size.

Output

Each URL returns HTTP status, aggregate score, cookie count, high-risk count, normalized per-cookie findings, fingerprint, snapshot-change status, removed-cookie names, regression state, issue codes, and an agentAction.

Example

{
  "urls": ["https://example.com"],
  "previousSnapshots": {},
  "failRunOnRisk": false,
  "maxUrls": 100
}

Use cases

• Authentication-cookie release QA.
• Framework or CDN migration validation.
• Scheduled security posture monitoring.
• Privacy engineering reviews.
• Agency client audits.
• CI regression gates for public sessions and state cookies.

Pricing

Billing is pay per audited URL result. The Actor does not require a commercial security scanner, browser farm, or AI service.

Limitations

The Actor observes server-delivered Set-Cookie headers from public unauthenticated requests. JavaScript-created cookies, authenticated-only cookies, browser storage APIs, and consent behavior requiring interaction are outside this static HTTP view.

Privacy and permissions

Analysis focuses on public response headers and cookie attributes. Cookie values are not required for the security findings and no login credentials are requested.