# Cookie Attributes Review Cookie Attributes Review is a tested SKILL.md that reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402. - Page: https://aiskills402.com/skills/cookie-attributes-review - Category: Code & Engineering (https://aiskills402.com/categories/code) - Price: $0.01 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative. - Version: 1.0.0 - Card (JSON): https://api.aiskills402.com/v1/skills/cookie-attributes-review ## Use it when Reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings. It catches a session cookie sent without Secure, a session cookie that script can read because HttpOnly is missing, SameSite=None without Secure, a __Host- cookie that carries a Domain or a Path other than the root, a Domain attribute wider than the host that needs the cookie, and a login cookie that lives for months. It leaves out the safe look-alikes, such as a theme or language cookie that script reads, a missing SameSite attribute, and SameSite=None together with Secure. Use to review the cookies of a login flow, to audit a framework's cookie settings, or before a security review of a web app. ## Not for Consent banners, cookie law, token issuing and revocation, cookie size limits and browser-specific caps. It reads pasted headers or cookie code and judges only the attributes written there; it cannot see framework defaults or a proxy that rewrites headers. ## Tested, honestly Tested 2026-10-26. - Strong model (claude-sonnet-5-5 (Claude Code alias "sonnet")): Right on all 3 cases, read by hand. On the shop headers it found the ninety-day login cookie and the __Host- cookie that carries a Domain, and left out the year-long theme cookie that has no flags at all. On the Flask handler it gave the readable token and the parent domain, and left out the SameSite=None that already comes with Secure and the language cookie. On the clean set of three cookies it answered exactly No findings. - Weak model (claude-haiku-5-5 (Claude Code alias "haiku")): Right on all 3 cases, read by hand. It matched the strong model on both planted inputs, with sound fixes, and kept the preference cookies and the Secure-protected SameSite=None out. On the clean set it answered exactly No findings. Its two answers on the planted inputs differ in layout only: one has a blank line between the findings and one is indented by four spaces, and the check accepts both. Note: Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from the public MDN page, read on 26 October 2026; the seven-day limit is our own, not MDN's. There are no owner-measured facts. Full summary: https://aiskills402.com/skills/cookie-attributes-review/tests ## Example ### English (claude-sonnet-5-5) Before: > Response headers of https://shop.example.com/login: Set-Cookie: sid=7f3a9c41; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=7776000 Set-Cookie: __Host-view=compact; Path=/; Domain=shop.example.com; Secure; SameSite=Lax Set-Cookie: ui_theme=dark; Path=/; Max-Age=31536000 After: > LONG-SESSION — sid, Max-Age=7776000 — ninety days is above the limit of 604800 — shorten it PREFIX-BROKEN — __Host-view, Domain=shop.example.com — a __Host- cookie must not carry a Domain attribute, so browsers will reject it — remove the Domain attribute ## What is in the file - What the MDN Set-Cookie page says, as published on 26 October 2026 - What counts as a session cookie - The answer - The codes - Rules - Work in this order - Short example ## Languages English ## How to buy Agent (HTTP): 1. GET https://api.aiskills402.com/v1/skills/cookie-attributes-review/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient. 2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm). 3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token. Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP. Full flow: https://aiskills402.com/docs ## The file - Version: 1.0.0 - Size: 5.9 KB (6081 bytes) - SHA-256: b4f0a323103406ce2cebf4e0571a2c8f8899d687330b3691088d95d22afe82c5 - Updated: 2026-10-26 - New versions are free through your re-download token. ## Versions ### 1.0.0 (2026-10-26) First release, written in the second light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from the public MDN page (see notes/ideas.md). Output: see the skill description. Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand. ## License Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license ## FAQ ### Theme or language cookie readable by script: reported? No. Only a login cookie needs the HttpOnly flag. A preference cookie, even a year-long one without Secure, gets no line, and neither does a cookie that sets no SameSite attribute at all. ### Where does the seven-day limit come from? From the skill itself. The MDN page names no figure for a login lifetime, so the 604800 seconds is stated as our own limit, and an Expires date counts only when the paste gives today's date. ### What went into the test? Three inputs: a set of response headers with a ninety-day login cookie and a broken host prefix, a Flask login handler with a readable token and a parent domain, and a clean set of three cookies. Each input went to Claude Sonnet once and to Claude Haiku once. ### What comes back for a clean set of cookies? A single sentence, No findings., and nothing around it. A defect is one line holding the code, the cookie, the reason and the fix, so the answer can be read in seconds or checked by a script. ## Measurement limits - Models other than the two named above were not run. - Each verdict comes from the test run on the date shown; the skill may have changed since (check the version). - Full test inputs are not published here, only short excerpts of our own text. - Results on your own texts, languages and domains can differ. Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.