Cookie Parser

Cookies have several attributes that control their behavior. Domain specifies which hosts receive the cookie (default: current host). Path limits the cookie to URLs under that path. Expires and Max-Age set when the cookie is deleted. Secure means the cookie is only sent over HTTPS. HttpOnly prevents JavaScript access. SameSite controls cross-site request behavior. Understanding these helps you build secure, correct cookie configurations.

For session and authentication cookies: always use Secure (HTTPS only), HttpOnly (no JS access), and SameSite=Lax or Strict. Avoid SameSite=None unless you need cross-site requests, and if you use it, Secure is required. Never store sensitive data in cookies without these flags. This tool highlights warnings when cookies lack these protections.

Set-Cookie is sent by the server in HTTP responses. document.cookie is the JavaScript API for reading and writing cookies. When building a cookie, you may need both formats: Set-Cookie for server responses, document.cookie for client-side code. Note that HttpOnly cannot be set via document.cookie — only the server can set that.