Are your session cookies actually hardened?

Paste the raw response headers from a login or token response — one or more Set-Cookie: lines, and optionally a Cache-Control: line. cookiecheck statically checks Secure, HttpOnly, SameSite, the __Host-/__Secure- prefix rules, Partitioned (CHIPS), cookie lifetime, and token-response cacheability against RFC 6265, the rfc6265bis draft, and the OAuth 2.0 Security BCP. No network calls. Cookie values are never stored or displayed — only names and flags.

Load example:

Response headers (Set-Cookie lines, optionally Cache-Control)

Only cookie names and attribute flags (Secure, HttpOnly, SameSite, …) are analyzed and saved. The cookie value — the part after the first = — is discarded before analysis and never appears in a report.