Cookie Security Calculator

Cookie score = 20 Secure + 18 HttpOnly + SameSite (20 Strict, 14 Lax, 4 None, 0 unset) + 8 __Host- prefix + 6 no Domain attribute + 4 path scoping + 12 rotation on login + lifetime score (12 at ≤1 h down to 0 above a week) = 100. Secure and HttpOnly carry the most weight because they close the two ways a cookie leaves the browser without the user acting: a plaintext request and an injected script. SameSite is scored on a sliding scale, and the lifetime term rewards short sessions since it directly bounds how long a stolen cookie is worth stealing.

Session cookies are the credential for the rest of the visit, so a missing flag converts a minor bug elsewhere — one mixed-content request, one XSS — into account takeover.

This calculator takes 8 inputs: Secure flag set, HttpOnly flag set, SameSite attribute, __Host- prefix used, No Domain attribute, so no subdomain sharing, Path scoped to the application root or narrower, Rotated on login and privilege change, Cookie lifetime. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

It makes the browser enforce the hardening for you: a cookie named __Host-session is only accepted if it is Secure, has no Domain attribute and has Path=/. That stops a compromised or attacker-controlled subdomain from overwriting your session cookie, which is a cookie-tossing attack that flags alone do not prevent.