cookieferry

An interactive SameSite, Secure, and Partitioned cookie debugger for cross-site web flows.

Chinese

cookieferry is a static website that answers a practical question: will this cookie be sent in this iframe, OAuth callback, SSO redirect, embedded widget, or same-site request?

It parses a Set-Cookie header, lets you choose the request context, and returns a verdict, findings, and a recommended header.

Why

Cookie behavior is easy to misread because the final outcome depends on both attributes and context:

• SameSite=None needs Secure.
• SameSite=Lax is not enough for cross-site POST callbacks or embedded requests.
• Secure needs HTTPS.
• Partitioned cookies require Secure.
• Unpartitioned third-party cookies can still be affected by browser policy.

The docs are good, but debugging usually happens under pressure. cookieferry turns scattered cookie rules into a working decision tool.

Research notes: docs/research.md

Use

Open index.html directly, or run a tiny static server:

npx serve .

Then paste a header such as:

sid=abc123; Path=/; SameSite=None; Secure; HttpOnly

Choose the context:

• iframe, fetch, image, embedded widget
• cross-site top-level navigation
• same-site request

The page updates live.

Features

• Pure static app, no backend
• Set-Cookie parser
• SameSite decision trace
• Secure and HTTPS checks
• Partitioned/CHIPS checks
• Recommended header generator
• Copy button
• Scenario presets for iframe, OAuth POST, and Partitioned widgets

Local Development

npm test
npx serve .

Roadmap

• Browser compatibility notes
• More OAuth/SSO recipes
• Export/share diagnosis links
• Dockerized demo contexts for local browser testing
• DevTools copy-paste helpers

Sources

• MDN Set-Cookie
• MDN Cookies Guide
• Chrome CHIPS

License

MIT