{
"url": "https://github.com/",
"finalUrl": "https://github.com/",
"statusCode": 200,
"redirectChain": [
{
"url": "https://github.com/",
"statusCode": 200,
"cookieCount": 3
}
],
"cookieCount": 3,
"grade": "A+",
"score": 99,
"summary": {
"errors": 0,
"warnings": 0,
"infos": 3
},
"cookies": [
{
"name": "_gh_sess",
"valueLength": 354,
"valuePreview": "55D…",
"attributes": {
"domain": null,
"path": "/",
"expires": null,
"maxAge": null,
"secure": true,
"httpOnly": true,
"sameSite": "Lax",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "session",
"seconds": null,
"source": null
},
"deletion": false,
"sizeBytes": 362,
"issues": [],
"score": 100,
"grade": "A+",
"setBy": {
"hop": 1,
"url": "https://github.com/",
"statusCode": 200
}
},
{
"name": "_octo",
"valueLength": 27,
"valuePreview": "GH1…",
"attributes": {
"domain": ".github.com",
"path": "/",
"expires": "2027-10-12T16:56:41.000Z",
"maxAge": null,
"secure": true,
"httpOnly": false,
"sameSite": "Lax",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "persistent",
"seconds": 31536000,
"source": "expires"
},
"deletion": false,
"sizeBytes": 32,
"issues": [
{
"severity": "info",
"code": "domain_leading_dot",
"message": "A leading dot in Domain is ignored by modern browsers (RFC 6265 section 5.2.3); it can be removed."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
}
],
"score": 98,
"grade": "A+",
"setBy": {
"hop": 1,
"url": "https://github.com/",
"statusCode": 200
}
},
{
"name": "logged_in",
"valueLength": 2,
"valuePreview": "…",
"attributes": {
"domain": ".github.com",
"path": "/",
"expires": "2027-10-12T16:56:41.000Z",
"maxAge": null,
"secure": true,
"httpOnly": true,
"sameSite": "Lax",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "persistent",
"seconds": 31536000,
"source": "expires"
},
"deletion": false,
"sizeBytes": 11,
"issues": [
{
"severity": "info",
"code": "domain_leading_dot",
"message": "A leading dot in Domain is ignored by modern browsers (RFC 6265 section 5.2.3); it can be removed."
}
],
"score": 99,
"grade": "A+",
"setBy": {
"hop": 1,
"url": "https://github.com/",
"statusCode": 200
}
}
],
"cached": false,
"checkedAt": "2026-10-12T16:56:41.406Z"
}
curl --location --request GET 'https://zylalabs.com/api/14204/set-cookie+analyzer+api/35259/analyze+the+set-cookie+headers+of+a+url' --header 'Authorization: Bearer YOUR_API_KEY'
{
"cookieCount": 3,
"grade": "D",
"score": 66,
"summary": {
"errors": 2,
"warnings": 4,
"infos": 5
},
"assumptions": {
"https": true,
"host": null,
"note": "Parsed offline. Secure checks assume the cookie was served over HTTPS (set \"https\": false to change); Domain checks run only when \"host\" is given."
},
"cookies": [
{
"name": "__Host-id",
"valueLength": 1,
"valuePreview": "…",
"attributes": {
"domain": "a.com",
"path": null,
"expires": null,
"maxAge": null,
"secure": false,
"httpOnly": false,
"sameSite": null,
"partitioned": false,
"priority": null
},
"prefix": "__Host-",
"lifetime": {
"type": "session",
"seconds": null,
"source": null
},
"deletion": false,
"sizeBytes": 10,
"issues": [
{
"severity": "error",
"code": "host_prefix_violation",
"message": "A __Host- cookie requires the Secure attribute, Path=/, no Domain attribute (RFC 6265bis section 4.1.3.2); browsers reject it otherwise."
},
{
"severity": "warning",
"code": "secure_missing",
"message": "The cookie has no Secure attribute although it was served over HTTPS, so browsers may also send it over plain HTTP."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
},
{
"severity": "info",
"code": "samesite_missing",
"message": "No SameSite attribute: browsers default to Lax (Chrome, Edge, Firefox in some modes). State the intent explicitly with SameSite=Lax, Strict or None."
}
],
"score": 63,
"grade": "D"
},
{
"name": "s",
"valueLength": 1,
"valuePreview": "…",
"attributes": {
"domain": null,
"path": null,
"expires": null,
"maxAge": null,
"secure": false,
"httpOnly": false,
"sameSite": "None",
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "session",
"seconds": null,
"source": null
},
"deletion": false,
"sizeBytes": 2,
"issues": [
{
"severity": "error",
"code": "samesite_none_requires_secure",
"message": "SameSite=None requires the Secure attribute; Chrome, Firefox and Safari reject the cookie otherwise (RFC 6265bis section 4.1.2.7)."
},
{
"severity": "warning",
"code": "secure_missing",
"message": "The cookie has no Secure attribute although it was served over HTTPS, so browsers may also send it over plain HTTP."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
}
],
"score": 64,
"grade": "D"
},
{
"name": "t",
"valueLength": 1,
"valuePreview": "…",
"attributes": {
"domain": null,
"path": null,
"expires": null,
"maxAge": 99999999,
"secure": false,
"httpOnly": false,
"sameSite": null,
"partitioned": false,
"priority": null
},
"prefix": null,
"lifetime": {
"type": "persistent",
"seconds": 99999999,
"source": "max-age"
},
"deletion": false,
"sizeBytes": 2,
"issues": [
{
"severity": "warning",
"code": "lifetime_exceeds_400_days",
"message": "The lifetime is about 1157 days; Chrome caps cookie lifetime at 400 days (RFC 6265bis section 5.5), so it will be truncated."
},
{
"severity": "warning",
"code": "secure_missing",
"message": "The cookie has no Secure attribute although it was served over HTTPS, so browsers may also send it over plain HTTP."
},
{
"severity": "info",
"code": "httponly_missing",
"message": "The cookie has no HttpOnly attribute, so scripts can read it. Fine if JavaScript needs it; otherwise add HttpOnly."
},
{
"severity": "info",
"code": "samesite_missing",
"message": "No SameSite attribute: browsers default to Lax (Chrome, Edge, Firefox in some modes). State the intent explicitly with SameSite=Lax, Strict or None."
}
],
"score": 78,
"grade": "C"
}
],
"checkedAt": "2026-10-12T16:57:50.219Z"
}
curl --location --request POST 'https://zylalabs.com/api/14204/set-cookie+analyzer+api/35260/analyze+pasted+set-cookie+header+text+offline' --header 'Authorization: Bearer YOUR_API_KEY'
--data-raw '{"headers":"Set-Cookie: __Host-id=1; Domain=a.com\nSet-Cookie: s=1; SameSite=None\nSet-Cookie: t=1; Max-Age=99999999"}'
注册后,每个开发者都会被分配一个个人 API 访问密钥,这是一个唯一的字母和数字组合,用于访问我们的 API 端点。要使用 设置Cookie分析器 API 进行身份验证,只需在 Authorization 标头中包含您的 bearer token。
| 标头 | 描述 |
|---|---|
授权
|
必需
应为 Bearer access_key. 订阅后,请查看上方的"您的 API 访问密钥"。
|
GET端点返回一个包含cookie分析结果的JSON对象,包括最终URL、状态代码、重定向链、cookie数量、等级、分数和详细的cookie属性 POST端点返回类似的数据,但重点关注提供的Set-Cookie头,包括错误、警告和cookie属性
关键字段包括 `url` `finalUrl` `statusCode` `cookieCount` `grade` `score` 和 `cookies` 每个 cookie 对象包含属性如 `name` `valueLength` `valuePreview` 和标志如 `secure` `httpOnly` 和 `sameSite`
返回的数据是JSON格式 结构包含一个顶级对象和一个Cookie对象数组 每个对象详细描述属性和合规问题 例如 `cookies` 数组包含单个Cookie的详细信息如 `name` `valueLength` 和 `attributes`
GET端点提供cookie属性、合规评级和重定向分析 POST端点提供关于提供的Set-Cookie头的见解,包括与cookie属性和合规标准相关的错误和警告
响应数据被组织为一个包含摘要信息的主对象和一个数组的cookie 每个cookie对象包括其属性和合规状态 使用户能够轻松评估cookie的安全性和符合标准情况
数据来自在分析指定URL或提供的Set-Cookie头时接收到的HTTP响应。API遵循RFC 6265和最佳实践来评估cookie属性和合规性
典型的用例包括审计Web应用程序的cookie安全性 确保遵守cookie标准 以及识别cookie配置中的潜在漏洞 开发人员可以将此分析集成到CI/CD管道中以进行自动检查
用户可以通过在 GET 端点中指定 `fresh` 参数来自定义请求,以绕过缓存结果。在 POST 端点中,用户可以以各种格式提供自定义 Set-Cookie 头,从而允许对特定 Cookie 进行定制分析