cookie-security-doctor

Audit Set-Cookie headers for Secure, HttpOnly, SameSite, prefixes, expiry, domain, and third-party cookie issues.

It is a practical deploy-time checker for authentication cookies, CSRF cookies, and browser cookie policy mistakes.

Quick start

curl -I https://example.com | npx cookie-security-doctor - --profile strict

npx cookie-security-doctor headers.txt --format markdown > COOKIE_REPORT.md
npx cookie-security-doctor headers.txt --profile session --fail-on-error
cat headers.txt | npx cookie-security-doctor - --profile strict

Input formats

• raw curl -I output
• plain Set-Cookie: lines
• JSON object with set-cookie
• JSON array of cookie strings

What it catches

• missing Secure
• sensitive cookies missing HttpOnly
• missing or invalid SameSite
• SameSite=None without Secure
• broad Domain cookies
• missing or invalid Path
• __Host- prefix violations
• __Secure- prefix violations
• invalid Max-Age / Expires
• already expired cookies
• long-lived sensitive cookies
• duplicate cookie names
• possible third-party cookie usage

Profiles

• basic — useful warnings without being too strict
• session — best for auth/session cookie reviews
• strict — production hardening mode

License

MIT