cookie attribute audit derived

{
  "input": {
    "body": {
      "contract": {
        "require_secure": true,
        "expected_domain": "example.test",
        "max_age_seconds": 86400,
        "require_http_only": true,
        "require_same_site": true
      },
      "set_cookie": [
        "session=abc123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=86400",
        "analytics_id=zz; Path=/; Domain=.example.test; Max-Age=31536000",
        "embed_state=1; Path=/; SameSite=None",
        "legacy=1; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=63072000"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxPages": 50,
        "maxListed": 200,
        "maxCookies": 100,
        "maxHeaders": 200,
        "maxFindings": 500,
        "maxHtmlBytes": 262144,
        "maxSitemapUrls": 10000,
        "maxSitemapBytes": 1048576
      },
      "passed": false,
      "cookies": [
        {
          "name": "session",
          "path": "/",
          "domain": null,
          "secure": true,
          "expires": null,
          "max_age": 86400,
          "http_only": true,
          "same_site": "lax",
          "value_length": 6,
          "session_scoped": false
        },
        {
          "name": "analytics_id",
          "path": "/",
          "domain": "example.test",
          "secure": false,
          "expires": null,
          "max_age": 31536000,
          "http_only": false,
          "same_site": null,
          "value_length": 2,
          "session_scoped": false
        },
        {
          "name": "embed_state",
          "path": "/",
          "domain": null,
          "secure": false,
          "expires": null,
          "max_age": null,
          "http_only": false,
          "same_site": "none",
          "value_length": 1,
          "session_scoped": true
        }
      ],
      "complete": false,
      "findings": [
        {
          "code": "COOKIE_NOT_SECURE",
          "cookie": "analytics_id",
          "detail": "analytics_id has no Secure attribute, so it is sent over plain HTTP as well."
        },
        {
          "code": "COOKIE_NOT_HTTP_ONLY",
          "cookie": "analytics_id",
          "detail": "analytics_id has no HttpOnly attribute, so page scripts can read it."
        },
        {
          "code": "COOKIE_SAME_SITE_ABSENT",
          "cookie": "analytics_id",
          "detail": "analytics_id declares no SameSite, so the browser default applies rather than a stated intent."
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "cookie_attribute_audit",
      "assumptions": [
        "No cookie value is ever returned, only its length. A session cookie value is a credential, and echoing one into a response body would be the problem rather than the audit.",
        "SameSite=None without Secure is reported as a cookie that will not be set at all, because browsers reject that combination outright rather than degrading it.",
        "A Domain attribute is reported whenever present, because it widens the cookie to every subdomain rather than the host that set it, which is a scope decision rather than a defect."
      ],
      "limitations": [
        "Attributes declared on the headers supplied. Whether a cookie is necessary, and what it contains, are outside this. Not a security assessment or a compliance determination.",
        "conformant is true only when every cookie parsed and every declared rule held."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "cookie_count": 4,
      "not_examined": [
        "COOKIE_IS_SESSION_SCOPED: embed_state declares neither Max-Age nor Expires, so it lasts for the browser session."
      ],
      "finding_count": 9,
      "service_version": "1.0.0",
      "findings_by_code": {
        "COOKIE_NOT_SECURE": 2,
        "COOKIE_NOT_HTTP_ONLY": 2,
        "COOKIE_SAME_SITE_ABSENT": 1,
        "COOKIE_SCOPED_TO_DOMAIN": 1,
        "COOKIE_LIFETIME_TOO_LONG": 2,
        "SAME_SITE_NONE_WITHOUT_SECURE": 1
      }
    }
  }
}