Set-Cookie header parser
Break one or more Set-Cookie header lines into name, attributes, and flags, on your device, with common misconfiguration warnings.
Set-Cookie header parser splits pasted Set-Cookie lines into name, value, Domain, Path, Expires or Max-Age, Secure, HttpOnly and SameSite fields, stripping a Set-Cookie: label if devtools left one on. It flags SameSite=None with no Secure flag, a missing Secure or HttpOnly flag alone, and a cookie with neither Domain nor Path set. That short list catches common mistakes, not a full review.
Questions
Can I paste more than one Set-Cookie line?
Yes, one per line; each is parsed and listed in its own table row.
Does it strip the header label?
Yes, a leading Set-Cookie: or Set-Cookie2: label, the way browser devtools often include one, is removed before parsing.
What four warnings does it check for?
SameSite=None without Secure, a missing Secure flag, a missing HttpOnly flag, and no Domain or Path attribute set at all.
Is a clean result a full security review?
No, the tool says explicitly that these four checks are not a full audit, only the most common misconfigurations.
What does it do with Max-Age versus Expires?
Max-Age wins over Expires when both are present, matching RFC 6265's own precedence rule.