Cookie Compliance (cookie-compliance)

Summary

Tracking cookies vs consent signals and cookie security flags.

Classification

• Category: SECURITY
• Plugin id: cookie-compliance
• Version: 1.0.0
• Target types: WEBSITE, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 4 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
knownTrackers	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for cookie-compliance.

Check	Typical severity	Why
Known tracking cookie set without consent (per cookie)	WARNING	Analytics/ad cookies (_ga, _fbp, etc.) on the first response imply tracking before consent — GDPR/ePrivacy risk and skewed baseline metrics.
Cookie missing Secure flag on HTTPS	WARNING	Cookies without Secure can leak on accidental HTTP links or mixed-content subrequests.
Cookie missing SameSite attribute	INFO	Without SameSite, browsers default to legacy cross-site behavior — CSRF and cross-site tracking via cookie sending become easier.

Default tracker cookies include _ga, _gid, _fbp, _fbc, fr, __gads, _gcl_au, NID, IDE, test_cookie, _uetsid.

How each check works

1. Fetch — Single GET to target URL via fetchTarget() (default timeout 10s). Failure → run failed, no findings.
2. Set-Cookie parsing — Reads all Set-Cookie headers via getSetCookie() (falls back to empty array if unsupported).
3. Per-cookie analysis — Splits name and attributes (case-insensitive). For each cookie:
   • Name in knownTrackers list (configurable, 11 defaults) → WARNING tracking-without-consent (one finding per matching cookie).
   • HTTPS target and missing Secure attribute → WARNING insecure cookie.
   • Missing any SameSite=* attribute → INFO no-SameSite (one finding per cookie).
4. HttpOnly not checked — Parsed but never emits findings.
5. Score — 100 if no cookies; else max(0, 100 - (findings.length / cookieCount) × 30).

Caveats and concerns

• No consent interaction — Does not click CMP banners or wait for deferred tag-manager loads; cookies set only after JS consent may be missed on the first fetch.
• First-party rename — Custom cookie names for GA/Meta not in knownTrackers bypass tracking findings.
• Legitimate pre-consent cookies — Strictly necessary session cookies still trigger SameSite INFO if the attribute is omitted — may be noisy on older frameworks.
• HTTP sites — Secure flag check is skipped when target URL is not https://; tracking cookie logic still runs.

Source

packages/test-plugins/src/plugins/cookie-compliance.ts