{"slug":"cookie-attributes-review","name":"Cookie Attributes Review","version":"1.0.0","updated_at":"2026-10-26T21:00:31.775Z","use_when":"Reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings. It catches a session cookie sent without Secure, a session cookie that script can read because HttpOnly is missing, SameSite=None without Secure, a __Host- cookie that carries a Domain or a Path other than the root, a Domain attribute wider than the host that needs the cookie, and a login cookie that lives for months. It leaves out the safe look-alikes, such as a theme or language cookie that script reads, a missing SameSite attribute, and SameSite=None together with Secure. Use to review the cookies of a login flow, to audit a framework's cookie settings, or before a security review of a web app.","not_for":"Consent banners, cookie law, token issuing and revocation, cookie size limits and browser-specific caps. It reads pasted headers or cookie code and judges only the attributes written there; it cannot see framework defaults or a proxy that rewrites headers.","languages":["en"],"tags":["cookies","set-cookie","session","samesite","http-headers","code-review"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["session cookie","set-cookie headers","samesite=none"],"faq":[{"q":"Theme or language cookie readable by script: reported?","a":"No. Only a login cookie needs the HttpOnly flag. A preference cookie, even a year-long one without Secure, gets no line, and neither does a cookie that sets no SameSite attribute at all."},{"q":"Where does the seven-day limit come from?","a":"From the skill itself. The MDN page names no figure for a login lifetime, so the 604800 seconds is stated as our own limit, and an Expires date counts only when the paste gives today's date."},{"q":"What went into the test?","a":"Three inputs: a set of response headers with a ninety-day login cookie and a broken host prefix, a Flask login handler with a readable token and a parent domain, and a clean set of three cookies. Each input went to Claude Sonnet once and to Claude Haiku once."},{"q":"What comes back for a clean set of cookies?","a":"A single sentence, No findings., and nothing around it. A defect is one line holding the code, the cookie, the reason and the fix, so the answer can be read in seconds or checked by a script."}],"examples":[{"lang":"en","model":"claude-sonnet-5-5","input_excerpt":"Response headers of https://shop.example.com/login:\n\nSet-Cookie: sid=7f3a9c41; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=7776000\nSet-Cookie: __Host-view=compact; Path=/; Domain=shop.example.com; Secure; SameSite=Lax\nSet-Cookie: ui_theme=dark; Path=/; Max-Age=31536000","output_excerpt":"LONG-SESSION — sid, Max-Age=7776000 — ninety days is above the limit of 604800 — shorten it\nPREFIX-BROKEN — __Host-view, Domain=shop.example.com — a __Host- cookie must not carry a Domain attribute, so browsers will reject it — remove the Domain attribute"}],"page_url":"https://aiskills402.com/skills/cookie-attributes-review","markdown_url":"https://aiskills402.com/skills/cookie-attributes-review.md","image_url":"https://cdn.aiskills402.com/og/skills/cookie-attributes-review/04f95bf7.png","related_url":"https://api.aiskills402.com/v1/skills/cookie-attributes-review/related","purchases_count":null,"tested":{"date":"2026-10-26","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Right on all 3 cases, read by hand. On the shop headers it found the ninety-day login cookie and the __Host- cookie that carries a Domain, and left out the year-long theme cookie that has no flags at all. On the Flask handler it gave the readable token and the parent domain, and left out the SameSite=None that already comes with Secure and the language cookie. On the clean set of three cookies it answered exactly No findings."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Right on all 3 cases, read by hand. It matched the strong model on both planted inputs, with sound fixes, and kept the preference cookies and the Secure-protected SameSite=None out. On the clean set it answered exactly No findings. Its two answers on the planted inputs differ in layout only: one has a blank line between the findings and one is indented by four spaces, and the check accepts both."},"note":"Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from the public MDN page, read on 26 October 2026; the seven-day limit is our own, not MDN's. There are no owner-measured facts.","report_url":null},"price_usd":"0.01","price_micro":10000,"size_bytes":6081,"sha256":"b4f0a323103406ce2cebf4e0571a2c8f8899d687330b3691088d95d22afe82c5","outline":["What the MDN Set-Cookie page says, as published on 26 October 2026","What counts as a session cookie","The answer","The codes","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/cookie-attributes-review/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4","facilitator":"cdp"},"seo_title":"Cookie Attributes Review for Login Cookies","seo_description":"Reviews Set-Cookie headers or cookie code for missing Secure and HttpOnly, SameSite none, broken prefixes and long logins. Pay $0.01 once, in USDC.","versions":[{"version":"1.0.0","date":"2026-10-26","changelog":"# Changelog\n\n## 1.0.0 — 2026-10-26\n\nFirst release, written in the second light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from the public MDN page (see notes/ideas.md). Output: see the skill description.\n\nTest: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.\n"}]}