{
"url": "https://github.com/",
"finalUrl": "https://github.com/",
"statusCode": 200,
"redirectChain": [
{
"url": "https://github.com/",
"statusCode": 200,
"cookieCount": 3
}
],
"cookieCount": 3,
"grade": "A+",
"score": 99,
"summary": {
"errors": 0,
"warnings": 0,
"infos": 3
},
"cookies": [
{
"name": "_gh_sess",
"valueLength": 354,
"valuePreview": "55D…",
"attributes": {
"domain": null,
"path": "/",
"expires": null,
"maxAge": null,
"secure": true,
"httpOnly": true,
"sameSite": "Lax",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "session",
"seconds": null,
"source": null
},
"deletion": false,
"sizeBytes": 362,
"issues": [],
"score": 100,
"grade": "A+",
"setBy": {
"hop": 1,
"url": "https://github.com/",
"statusCode": 200
}
},
{
"name": "_octo",
"valueLength": 27,
"valuePreview": "GH1…",
"attributes": {
"domain": ".github.com",
"path": "/",
"expires": "2027-10-12T16:56:41.000Z",
"maxAge": null,
"secure": true,
"httpOnly": false,
"sameSite": "Lax",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "persistent",
"seconds": 31536000,
"source": "expires"
},
"deletion": false,
"sizeBytes": 32,
"issues": [
{
"severity": "info",
"code": "domain_leading_dot",
"message": "A leading dot in Domain is ignored by modern browsers (RFC 6265 section 5.2.3); it can be removed."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
}
],
"score": 98,
"grade": "A+",
"setBy": {
"hop": 1,
"url": "https://github.com/",
"statusCode": 200
}
},
{
"name": "logged_in",
"valueLength": 2,
"valuePreview": "…",
"attributes": {
"domain": ".github.com",
"path": "/",
"expires": "2027-10-12T16:56:41.000Z",
"maxAge": null,
"secure": true,
"httpOnly": true,
"sameSite": "Lax",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "persistent",
"seconds": 31536000,
"source": "expires"
},
"deletion": false,
"sizeBytes": 11,
"issues": [
{
"severity": "info",
"code": "domain_leading_dot",
"message": "A leading dot in Domain is ignored by modern browsers (RFC 6265 section 5.2.3); it can be removed."
}
],
"score": 99,
"grade": "A+",
"setBy": {
"hop": 1,
"url": "https://github.com/",
"statusCode": 200
}
}
],
"cached": false,
"checkedAt": "2026-10-12T16:56:41.406Z"
}
curl --location --request GET 'https://zylalabs.com/api/14204/set-cookie+analyzer+api/35259/analyze+the+set-cookie+headers+of+a+url' --header 'Authorization: Bearer YOUR_API_KEY'
{
"cookieCount": 3,
"grade": "D",
"score": 66,
"summary": {
"errors": 2,
"warnings": 4,
"infos": 5
},
"assumptions": {
"https": true,
"host": null,
"note": "Parsed offline. Secure checks assume the cookie was served over HTTPS (set \"https\": false to change); Domain checks run only when \"host\" is given."
},
"cookies": [
{
"name": "__Host-id",
"valueLength": 1,
"valuePreview": "…",
"attributes": {
"domain": "a.com",
"path": null,
"expires": null,
"maxAge": null,
"secure": false,
"httpOnly": false,
"sameSite": null,
"partitioned": false,
"priority": null
},
"prefix": "__Host-",
"lifetime": {
"type": "session",
"seconds": null,
"source": null
},
"deletion": false,
"sizeBytes": 10,
"issues": [
{
"severity": "error",
"code": "host_prefix_violation",
"message": "A __Host- cookie requires the Secure attribute, Path=/, no Domain attribute (RFC 6265bis section 4.1.3.2); browsers reject it otherwise."
},
{
"severity": "warning",
"code": "secure_missing",
"message": "The cookie has no Secure attribute although it was served over HTTPS, so browsers may also send it over plain HTTP."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
},
{
"severity": "info",
"code": "samesite_missing",
"message": "No SameSite attribute: browsers default to Lax (Chrome, Edge, Firefox in some modes). State the intent explicitly with SameSite=Lax, Strict or None."
}
],
"score": 63,
"grade": "D"
},
{
"name": "s",
"valueLength": 1,
"valuePreview": "…",
"attributes": {
"domain": null,
"path": null,
"expires": null,
"maxAge": null,
"secure": false,
"httpOnly": false,
"sameSite": "None",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "session",
"seconds": null,
"source": null
},
"deletion": false,
"sizeBytes": 2,
"issues": [
{
"severity": "error",
"code": "samesite_none_requires_secure",
"message": "SameSite=None requires the Secure attribute; Chrome, Firefox and Safari reject the cookie otherwise (RFC 6265bis section 4.1.2.7)."
},
{
"severity": "warning",
"code": "secure_missing",
"message": "The cookie has no Secure attribute although it was served over HTTPS, so browsers may also send it over plain HTTP."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
}
],
"score": 64,
"grade": "D"
},
{
"name": "t",
"valueLength": 1,
"valuePreview": "…",
"attributes": {
"domain": null,
"path": null,
"expires": null,
"maxAge": 99999999,
"secure": false,
"httpOnly": false,
"sameSite": null,
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "persistent",
"seconds": 99999999,
"source": "max-age"
},
"deletion": false,
"sizeBytes": 2,
"issues": [
{
"severity": "warning",
"code": "lifetime_exceeds_400_days",
"message": "The lifetime is about 1157 days; Chrome caps cookie lifetime at 400 days (RFC 6265bis section 5.5), so it will be truncated."
},
{
"severity": "warning",
"code": "secure_missing",
"message": "The cookie has no Secure attribute although it was served over HTTPS, so browsers may also send it over plain HTTP."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
},
{
"severity": "info",
"code": "samesite_missing",
"message": "No SameSite attribute: browsers default to Lax (Chrome, Edge, Firefox in some modes). State the intent explicitly with SameSite=Lax, Strict or None."
}
],
"score": 78,
"grade": "C"
}
],
"checkedAt": "2026-10-12T16:57:50.219Z"
}
curl --location --request POST 'https://zylalabs.com/api/14204/set-cookie+analyzer+api/35260/analyze+pasted+set-cookie+header+text+offline' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"headers":"Set-Cookie: __Host-id=1; Domain=a.com\nSet-Cookie: s=1; SameSite=None\nSet-Cookie: t=1; Max-Age=99999999"}'
After signing up, every developer is assigned a personal API access key, a unique combination of letters and digits provided to access to our API endpoint. To authenticate with the Set-Cookie Analyzer API simply include your bearer token in the Authorization header.
| Header | Description |
|---|---|
Authorization
|
Required
Should be Bearer access_key. See "Your API Access Key" above when you are subscribed.
|
No long-term commitment. Upgrade, downgrade, or cancel anytime. Free Trial includes up to 50 requests.
The GET endpoint returns a JSON object containing cookie analysis results, including the final URL, status code, redirect chain, cookie count, grade, score, and detailed cookie attributes. The POST endpoint returns similar data but focuses on the provided Set-Cookie headers, including errors, warnings, and cookie attributes.
Key fields include `url`, `finalUrl`, `statusCode`, `cookieCount`, `grade`, `score`, and `cookies`. Each cookie object contains attributes like `name`, `valueLength`, `valuePreview`, and flags such as `secure`, `httpOnly`, and `sameSite`.
The returned data is in JSON format. The structure includes a top-level object with summary information and an array of cookie objects, each detailing attributes and compliance issues. For example, the `cookies` array contains individual cookie details like `name`, `valueLength`, and `attributes`.
The GET endpoint provides cookie attributes, compliance grades, and redirect analysis. The POST endpoint offers insights into the provided Set-Cookie headers, including errors and warnings related to cookie attributes and compliance with standards.
The response data is organized into a main object containing summary information and an array of cookies. Each cookie object includes its attributes and compliance status, allowing users to easily assess cookie security and adherence to standards.
The data is sourced from the HTTP responses received during the analysis of the specified URL or the provided Set-Cookie headers. The API follows RFC 6265 and best practices to evaluate cookie attributes and compliance.
Typical use cases include auditing cookie security for web applications, ensuring compliance with cookie standards, and identifying potential vulnerabilities in cookie configurations. Developers can integrate this analysis into CI/CD pipelines for automated checks.
Users can customize requests by specifying the `fresh` parameter in the GET endpoint to bypass cached results. In the POST endpoint, users can provide custom Set-Cookie headers in various formats, allowing for tailored analysis of specific cookies.
To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
The free trial lasts for 7 days and allows you to make up to 50 API requests.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
You can monitor your API usage through the response headers included with every request:
x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.
Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.
Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund