Cookie Scope Simulator

Audit Set-Cookie acceptance and later cookie scope without making any HTTP requests.

Set-Cookie input and setting context

Response URL setting the cookies

Top-level site URL when set (partition key)

One Set-Cookie field value per line (maximum 500 lines / 256 KiB)

Do not include the Set-Cookie: field name. Commas are not separators because Expires dates contain commas. Control characters, CR/LF injection, invalid names, and overlong lines are rejected.

Simulated access context

Request/document URL

Current top-level site URL

Request method

Request context

Current time

Model limitations: schemeful sites are approximated from the final registrable-looking labels using a small built-in list for common two-label suffixes—not a current Public Suffix List. Unicode URL hosts are normalized by the URL parser, but Unicode Domain attributes and unusual IP spellings are not modeled. Expires parsing uses the browser's date parser, and omitted SameSite is modeled as Lax without the short Lax-allowing-unsafe exception. Browser version, cookie policy, third-party blocking, Fetch credentials mode, CORS, localhost exceptions, First-Party Sets, cookie quotas, and partitioning implementation can change real behavior. This is an RFC6265bis-style teaching audit, not a browser conformance result.

Audit report

Storage and inclusion decisions

Cookie	Stored?	Domain	Path	SameSite	Request?	document.cookie?	Explanation

Simulated Cookie request header

Simulated document.cookie string

HttpOnly cookies may appear in the request header but are never exposed through document.cookie. JavaScript also cannot read attributes such as expiry, SameSite, Secure, or Path through that string.