Discuss your project

TOOLBOX · SECURITY CHECK

Check Cookies.

Which cookies does your website set on the first visit, and are they protected? Enter a domain and see per cookie what is missing.

The bot check protects the toolbox against automated abuse.

We fetch the home page once, like a browser on the first visit, and read the cookies the server sets. We do not store results permanently.

WHAT IS CHECKED

Every Cookie.
Rated Separately.

Cookies carry sign-ins, shopping carts and settings. A few attributes in the Set-Cookie header decide whether they can be read along the way, read by scripts or sent along from other websites.

  • 01

    Secure

    The browser only sends the cookie over HTTPS. If Secure is missing on a session cookie, that is critical: anyone reading along on the connection can take over the sign-in.

  • 02

    HttpOnly

    Scripts on the page cannot read the cookie. A cross-site scripting gap therefore cannot get at the session cookie.

  • 03

    SameSite

    Controls whether the cookie is sent with requests that start on other websites. Browsers discard SameSite=None without Secure entirely.

  • 04

    Prefixes

    __Host- and __Secure- in the name commit the browser to strict rules. If a cookie does not keep them, it is discarded.

  • 05

    Domain and Lifetime

    A Domain attribute opens the cookie to all subdomains. Very long lifetimes make devices recognizable for a long time.

  • 06

    Consent

    If the server already sets known analytics or advertising cookies on the first request, we point this out. The vendors themselves say which ones these are.

LIMITS OF THE CHECK

What the Server
Does Not Reveal.

The check sees what the server sends with Set-Cookie: on the first request of the home page, without consent. A result without findings does not mean that your website sets no tracking cookies.

  • Not covered: cookies that JavaScript sets in the browser, such as Google Analytics, the Meta Pixel or a consent banner in the usual integration.
  • Not covered: cookies after a sign-in, in the shopping cart, after consent or only on subpages.
  • Not covered: cookies of embedded third-party content such as videos, maps or chat windows. They belong to their domains.
  • We recognize session cookies by the default names of common platforms such as PHPSESSID, JSESSIONID or ASP.NET_SessionId and by name parts such as “sess”, “auth” or “login”.

The developer tools of your browser show all cookies of a page, including those set by JavaScript: in Chrome and Edge with F12, then under “Application” at “Cookies”. Open the page in a private window for this and do not choose anything in the consent banner yet.

CONFIGURATION

Three Attributes.
A Few Lines.

This is how common servers and frameworks set Secure, HttpOnly and SameSite. HttpOnly belongs on cookies that your own JavaScript does not need to read, above all on session cookies. Then check again.

  • nginx as a Reverse Proxy

    From version 1.19.3, proxy_cookie_flags sets the attributes for cookies of the application behind it. The first matching line applies; ~ without a pattern matches all other cookies.

    # in the server or location block with proxy_pass
proxy_cookie_flags PHPSESSID secure httponly samesite=lax;
proxy_cookie_flags ~ secure samesite=lax;

    Source: nginx documentation

  • Apache

    Header edit appends attributes to existing Set-Cookie lines. Headers from CGI scripts and mod_proxy_fcgi (such as PHP-FPM) are in the always table; if the line finds nothing, add the same line without always as well.

    # Apache 2.4 with mod_headers
Header always edit Set-Cookie "^(.*)$" "$1; Secure"
Header always edit Set-Cookie "^(PHPSESSID=.*)$" "$1; HttpOnly; SameSite=Lax"

    Source: Apache mod_headers

  • PHP

    php.ini controls the session cookie, the options of setcookie control cookies of your own. Without settings, PHP sets neither Secure nor HttpOnly.

    ; php.ini or .user.ini
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"
session.use_strict_mode = 1

// cookies of your own (from PHP 7.3)
setcookie('name', $value, ['path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'Lax']);

    Source: PHP manual

  • Node.js with Express

    express-session already sets HttpOnly on its own, but not Secure and SameSite. Behind a proxy, Secure needs the trust proxy setting.

    // behind a reverse proxy with HTTPS
app.set('trust proxy', 1);
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {secure: true, httpOnly: true, sameSite: 'lax'},
}));

// cookies of your own
res.cookie('name', value, {secure: true, httpOnly: true, sameSite: 'lax'});

    Source: express-session

  • ASP.NET Core

    The cookie policy applies to all cookies of the application. Use HttpOnlyPolicy.Always only if no script of your own needs to read cookies.

    // Program.cs
using Microsoft.AspNetCore.CookiePolicy;

builder.Services.Configure<CookiePolicyOptions>(options =>
{
    options.Secure = CookieSecurePolicy.Always;
    options.HttpOnly = HttpOnlyPolicy.Always;
    options.MinimumSameSitePolicy = SameSiteMode.Lax;
});
// …
app.UseCookiePolicy();

    Source: Microsoft Learn

  • ASP.NET (.NET Framework)

    In web.config for all cookies of the application. The setting knows SameSite from .NET Framework 4.7.2.

    <!-- web.config, from .NET Framework 4.7.2 -->
<system.web>
  <httpCookies requireSSL="true" httpOnlyCookies="true" sameSite="Lax" />
</system.web>

    Source: Microsoft Learn

QUESTIONS

Good to Know.

What does the cookie check test?

It fetches the home page of your website once, like a browser on the first visit, follows up to five redirects and reads all cookies the server sets with Set-Cookie. Every cookie is rated separately: Secure, HttpOnly, SameSite, the prefixes __Host- and __Secure-, the Domain attribute, the lifetime and whether, according to the vendor, it serves analytics or advertising.

My website uses Google Analytics. Why does the check find nothing?

Google Analytics, the Meta Pixel and many other services set their cookies with JavaScript in the browser in the usual integration, not through the server. A request by our server does not see these cookies, nor cookies that only appear after a sign-in, in the shopping cart or after consent. A result without findings therefore does not mean that your website sets no tracking cookies. The developer tools of your browser give the complete overview.

Does every cookie need consent?

No. Under Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), collecting data requires active consent based on clear and comprehensive information. Excluded is what is strictly necessary for a service expressly requested by the user to work. Whether a cookie belongs to this depends on its purpose. The check only points out cookies that, according to the vendor, serve analytics or advertising and that the server sets without any choice. It does not replace a legal review.

How is the grade calculated?

Every check has a weight: HTTPS 10, Secure 20, HttpOnly on session cookies 15, SameSite=None only with Secure 10, prefixes 10 (if a cookie carries one), Domain 5 and analytics or advertising cookies without consent 10. Passed counts in full, a warning counts half, a critical finding counts nothing; a critical finding limits the grade to C at best. If the home page sets no cookies at all, there is nothing to rate. The grade is then based only on whether the page is delivered over HTTPS, and the report says so.

Does TOMORIS store the cookies of my website?

No. The website checked sets its cookies with our server, not in your browser. We only evaluate names and attributes; the values appear neither in the report nor in the cache. We keep the report in memory for five minutes so that repeated requests do not put load on the website again; it is deleted after six minutes at the latest.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result