What it does

Set-Cookie Analyzer inspects cookies for missing Secure, HttpOnly and SameSite flags. It also checks for violations of RFC 6265 and the RFC 6265bis draft. Send a URL to GET /v1/analyze, and the service makes one anonymous GET request from its servers. It follows up to 5 redirect hops and analyzes the cookies from every hop. Cookies set by JavaScript, or only after login or consent, are not visible to it. Send Set-Cookie header text to POST /v1/parse, and the service parses it offline with no outbound request. Both endpoints return per-cookie attributes, coded issues, a grade from A+ to F and a score out of 100. The grade and score describe cookie attributes only. You can call the service through the APIHub CLI or through the proxy at proxy.apihub.io with a bearer key.

Capabilities

Each cookie report includes __Host-/__Secure- prefix rules, lifetime and size.
Checks cover SameSite=None needing Secure, prefix requirements, the 400-day lifetime cap and the 4096-byte limit.
Session-like cookie names that lack HttpOnly are flagged as a common best-practice issue.
Each cookie is reported with a valueLength and a masked valuePreview of at most the first 3 characters instead of the full value.
Results for /v1/analyze are cached for 6 hours per URL, and adding fresh=1 bypasses the cache. Private-network targets are rejected.

When to use it

You need to check the cookies a website sets from CI or a script.
You need to see which cookies appear at each redirect hop of a URL.
You have Set-Cookie header text and want to parse it offline without an outbound request.