By · Updated

SameSite Cookie Tester

Where Each Cookie Is Sent Cross-Site Under SameSite Lax, Strict or None

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the SameSite Cookie Tester works

This SameSite cookie tester reads your Set-Cookie headers and shows, for each cookie, whether the browser sends it on a same-site request, a link from another site, a cross-site form post and an embedded iframe or fetch. It also catches the settings browsers reject outright.

What the SameSite cookie tester shows

SameSite decides whether a cookie goes along with requests that start on another site. Strict cookies are only sent when the user is already on your site. Lax cookies are also sent when a user follows a link to you, but not on cross-site form posts or embedded requests, which blocks most cross-site request forgery. None sends the cookie everywhere, and browsers insist it is also marked Secure; without it the cookie is rejected.

A cookie with no SameSite attribute is treated as Lax by Chrome and Edge, while Firefox and Safari still treat it as None. Chrome makes one exception: a cookie without the attribute is sent on cross-site POSTs for two minutes after it is set, so sign-in flows keep working.

The tester also checks the __Secure- and __Host- name prefixes, Partitioned cookies and cookies without HttpOnly.

FAQ

Which SameSite value should a session cookie use?

Use Lax for most session cookies, because it keeps users signed in when they arrive from a link while blocking cross-site form posts. Use Strict for high-value actions such as banking, and None only for cookies that must work inside an iframe on another site.

Why is my SameSite=None cookie still not sent in an iframe?

Many browsers now block third-party cookies by default or in private modes, whatever the SameSite value. Adding the Partitioned attribute (CHIPS) lets the cookie work in that embed, stored separately for each top-level site.

How do I paste several cookies at once?

Put one Set-Cookie header per line. The Set-Cookie prefix is optional, so you can paste lines straight from curl output or from the browser developer tools. Each cookie gets its own row in the table.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

Cookie Parser

Break Set-Cookie and Cookie headers into readable attributes with warnings.

Security Headers Checker

Check pasted response headers for missing, weak and leaky security headers.

CORS Tester

Test a URL for CORS headers or analyse pasted ones.

HTTP Header Inspector

Parse pasted HTTP headers, explain each one and audit security.

Cookie Consent Checker

Find analytics and ad cookies set before visitors give consent.