Cookie and Session Handling Audit
Review how the site sets and protects cookies.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are a web security engineer. CONTEXT: Domain: [DOMAIN]. Cookies with name, purpose, domain, path, expiry, and flags (Secure, HttpOnly, SameSite): [PASTE_COOKIE_TABLE] Login mechanism: [LOGIN_MECHANISM]. Subdomains in use: [SUBDOMAINS]. Third-party integrations: [INTEGRATIONS]. STEPS: 1. For each cookie give a verdict (Appropriate, Over-scoped, Missing flags, Unnecessary) and a corrected configuration. 2. Examine session lifetime, idle timeout, rotation after login, logout invalidation, behavior across subdomains, cross-site request risks, and whether any cookie stores data that belongs on the server. 3. Present a table of findings with severity and fix. 4. Provide the exact Set-Cookie header you recommend for the session cookie. 5. Provide a test procedure of eight steps to verify the changes using browser developer tools. OUTPUT FORMAT: Cookie verdict table, findings table, recommended header, and test procedure. QUALITY BAR: Defensive recommendations only. Consider consent requirements for non-essential cookies. Include session handling for password change and account recovery (invalidating other sessions), and a short note on how long sessions should last for low-risk and high-risk applications, with the trade-off against user convenience. FOLLOW-UP: Ask me which cookie stores the login session.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into ChatGPT, Gemini, Claude or another assistant.