Cookie Attribute Audit

Name: Cookie Attribute Audit
Price: 0.12 USDC
Availability: OutOfStock

Parse Set-Cookie headers and report their attributes. Names cookies with no Secure, no HttpOnly or no SameSite; SameSite=None without Secure, which browsers reject so the cookie is never set at all; an unrecognised SameSite value, where the default applies instead; a lifetime beyond a stated maximum; an unexpected Domain; and a Domain attribute at all, which widens a cookie to every subdomain. No cookie value is returned, only its length.

Infraofflineeip155:8453Exactvia cdp

https://api.zfinia.com/x402/v1/cookie-attribute-audit

CookiesHttp headersWeb platformDeveloper toolingCi gate

Settlements · 30d

219↓ 44%

No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days.

$25.35

Verified settled volume

256 settlements proven x402 by their on-chain EIP-3009 marker.

$0.120

Listed price

As published in the catalog. Always read the live 402 before paying.

Calls · 30d

Upstream's own call count for this endpoint, not ours.

Unique payers · 30d

Last called 2026-10-04 08:17Z

—

Upstream on-chain volume

Reported by the source catalog.

Paid to

0x25e8245f07d5e4873987293dad666afbe56a9608

The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.

Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Provider

The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

0.12USDC≈ $0.12 USD

on Base · exact scheme

Pay 0.12 USDC on Base to 0x25e8…a9608. The signed payment is good for 1 minute.

Paid to: 0x25e8…a9608
USD Coin contract: 0x8335…02913
Payment window: 1 minute
As published: 120000 smallest units

The catalog’s raw entry

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "120000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "contract": {
            "require_secure": true,
            "expected_domain": "example.test",
            "max_age_seconds": 86400,
            "require_http_only": true,
            "require_same_site": true
          },
          "set_cookie": [
            "session=abc123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=86400",
            "analytics_id=zz; Path=/; Domain=.example.test; Max-Age=31536000",
            "embed_state=1; Path=/; SameSite=None",
            "legacy=1; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=63072000"
          ]
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "limits": {
            "maxPages": 50,
            "maxListed": 200,
            "maxCookies": 100,
            "maxHeaders": 200,
            "maxFindings": 500,
            "maxHtmlBytes": 262144,
            "maxSitemapUrls": 10000,
            "maxSitemapBytes": 1048576
          },
          "passed": false,
          "cookies": [
            {
              "name": "session",
              "path": "/",
              "domain": null,
              "secure": true,
              "expires": null,
              "max_age": 86400,
              "http_only": true,
              "same_site": "lax",
              "value_length": 6,
              "session_scoped": false
            },
            {
              "name": "analytics_id",
              "path": "/",
              "domain": "example.test",
              "secure": false,
              "expires": null,
              "max_age": 31536000,
              "http_only": false,
              "same_site": null,
              "value_length": 2,
              "session_scoped": false
            },
            {
              "name": "embed_state",
              "path": "/",
              "domain": null,
              "secure": false,
              "expires": null,
              "max_age": null,
              "http_only": false,
              "same_site": "none",
              "value_length": 1,
              "session_scoped": true
            }
          ],
          "complete": false,
          "findings": [
            {
              "code": "COOKIE_NOT_SECURE",
              "cookie": "analytics_id",
              "detail": "analytics_id has no Secure attribute, so it is sent over plain HTTP as well."
            },
            {
              "code": "COOKIE_NOT_HTTP_ONLY",
              "cookie": "analytics_id",
              "detail": "analytics_id has no HttpOnly attribute, so page scripts can read it."
            },
            {
              "code": "COOKIE_SAME_SITE_ABSENT",
              "cookie": "analytics_id",
              "detail": "analytics_id declares no SameSite, so the browser default applies rather than a stated intent."
            }
          ],
          "conformant": false,
          "request_id": "example-request",
          "service_id": "cookie_attribute_audit",
          "assumptions": [
            "No cookie value is ever returned, only its length. A session cookie value is a credential, and echoing one into a response body would be the problem rather than the audit.",
            "SameSite=None without Secure is reported as a cookie that will not be set at all, because browsers reject that combination outright rather than degrading it.",
            "A Domain attribute is reported whenever present, because it widens the cookie to every subdomain rather than the host that set it, which is a scope decision rather than a defect."
          ],
          "limitations": [
            "Attributes declared on the headers supplied. Whether a cookie is necessary, and what it contains, are outside this. Not a security assessment or a compliance determination.",
            "conformant is true only when every cookie parsed and every declared rule held."
          ],
          "observed_at": "2026-10-02T00:00:00.000Z",
          "cookie_count": 4,
          "not_examined": [
            "COOKIE_IS_SESSION_SCOPED: embed_state declares neither Max-Age nor Expires, so it lasts for the browser session."
          ],
          "finding_count": 9,
          "service_version": "1.0.0",
          "findings_by_code": {
            "COOKIE_NOT_SECURE": 2,
            "COOKIE_NOT_HTTP_ONLY": 2,
            "COOKIE_SAME_SITE_ABSENT": 1,
            "COOKIE_SCOPED_TO_DOMAIN": 1,
            "COOKIE_LIFETIME_TOO_LONG": 2,
            "SAME_SITE_NONE_WITHOUT_SECURE": 1
          }
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "set_cookie"
              ],
              "properties": {
                "contract": {
                  "type": "object",
                  "properties": {
                    "require_secure": {
                      "type": "boolean"
                    },
                    "expected_domain": {
                      "type": "string",
                      "maxLength": 256
                    },
                    "max_age_seconds": {
                      "type": "number",
                      "minimum": 0
                    },
                    "require_http_only": {
                      "type": "boolean"
                    },
                    "require_same_site": {
                      "type": "boolean"
                    },
                    "forbid_same_site_none": {
                      "type": "boolean"
                    }
                  },
                  "additionalProperties": false
                },
                "set_cookie": {
                  "type": "array",
                  "items": {
                    "type": "string",
                    "maxLength": 8192
                  },
                  "maxItems": 100,
                  "minItems": 1
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog: 2026-10-04 08:17Z
Last indexed by Roundhouse: 2026-10-05 00:20Z
Last enriched (probe, favicon, geo): 2026-10-05 00:46Z
x402 version: 2
Max timeout: 60s
Liveness probe: HTTP 0

Report

Hand this page to an agent

Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.

GET api.roundhouseai.io/v0/endpoints

No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days. Verified volume counts only settlements with an on-chain EIP-3009 marker.

Open skill.md

Show the prompt

Using Roundhouse, look up the x402 service Cookie Attribute Audit and tell me whether it is
worth paying: what a call costs, whether the endpoint answered when last probed, and what
its payment record actually shows.

curl -s 'https://api.roundhouseai.io/v0/endpoints?q=Cookie%20Attribute%20Audit'
curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>'

Then call it: read the price from the live 402 at https://api.zfinia.com/x402/v1/cookie-attribute-audit, never from
a cached figure, and pay with an x402 client.

The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except
/v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at
GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at
https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further.

If you do not have Roundhouse tools or skills installed, read
https://roundhouseai.io/skill.md first — it is the whole procedure.