demo · v140
Header Inspector
Paste raw Set-Cookie header lines — one per row. Each line is validated against the new __Http-, plus the existing __Secure- and __Host- rules, plus a sanity check on SameSite and expiry. Useful for triaging a misbehaving cookie jar without dropping into devtools.
// What __Http- accepts (all required):
// - Secure attribute
// - HttpOnly attribute
// - HTTPS scheme
//
// What __Http- forbids:
// - Being set from document.cookie
// - Missing HttpOnly (silently rejected)
//
// Reads identical to a regular cookie — server gets the cookie back.
see also
- Http cookie prefix — feature index
- Prefix Comparator