Description
Check the supplied SameSite/Secure pair under the rule that SameSite None requires Secure.
Web protocol data has several layers: a complete message or URL, individual fields or components, and the literal tokens within them. Delimiter presence, spelling, comparison rules, and parser normalization can affect results. A check of one component needs its stated scope before it can be used in a larger parser or policy decision.
Check the supplied SameSite/Secure pair under the rule that SameSite None requires Secure.
When to use this tool
Use Cookie Samesite None Secure Pair when you need one stated URL, header, or protocol-component check in a diagnostic or parser workflow. Supply the input level specified below.
How to use the tool and how it works
- Enter sameSite, secure. Use the units and conventions below.
- Run the tool. Correct any format, range, or cross-field input error before interpreting the output.
- Read requiresSecure, valid. Inspect requiresSecure, valid before interpreting the associated values.
Require sameSite to equal Strict, Lax, None, or unspecified. Set requiresSecure for None and valid unless None is paired with secure false.1
| Input field | Meaning and units | Accepted input |
|---|---|---|
| sameSite | Same Site | Required. Text; one of "Strict", "Lax", "None", "unspecified"; maximum UTF-16 length 8192. |
| secure | Secure | Required. Boolean. |
| Output field | Interpretation | Returned shape |
|---|---|---|
| requiresSecure | Requires Secure | Required. Boolean. |
| valid | Whether this tool’s particular check passes; does not imply broader identifier or protocol validity. | Required. Boolean. |
{
"input": {
"sameSite": "None",
"secure": false
},
"output": {
"requiresSecure": true,
"valid": false
}
}Limitations and assumptions
- This checks one supplied attribute pair, not complete cookie acceptance. Other cookie attributes, browser policy, third-party restrictions, and the security of a site remain outside the check.
- The field tables state structural bounds; the mechanics also specify cross-field constraints. Malformed inputs and unsupported domains cause errors. A successful false flag, empty branch value, or zero placeholder has the meaning stated above and is distinct from an input error.
Alternative or Complementary methods
Use a complete URL or header parser when the task involves an entire field or message. Test actual browser, server, or cache behavior separately when a security or protocol decision depends on more than this component.
References
Similar or alternative tools
- Cookie Domain Leading Dot Normalization
Remove one optional leading dot and require a hostname no longer than 253 characters with ASCII labels from one through 63 characters and no leading or trailing hyphen.
- Cookie Host Only Domain Attribute Flag
Treat empty domainAttribute as hostOnly.