Audit a Hardened Session Cookie

Challenge

The problem

A session cookie is the key to a logged-in account. If an attacker can read it (over plain HTTP, or via JavaScript in an XSS) or replay it from a malicious cross-site request, they hijack the session. Three Set-Cookie attributes shut those doors: Secure (never sent over plain HTTP), HttpOnly (invisible to document.cookie), and SameSite (blocks cross-site sending, so it needs a real value like Strict, Lax, or None).

The insecure assumption is that a cookie "looks fine" — developers eyeball the header and miss a missing flag. Your job is an automated audit that DENIES by default: a cookie is only approved when ALL THREE protections are present.

Task

Implement is_secure_cookie. Given a NUL-terminated Set-Cookie header string, return 1 only if it sets Secure, HttpOnly, AND a SameSite with a non-empty value; otherwise return 0. Scan attributes as ;-separated tokens, trim surrounding whitespace, and match attribute names case-insensitively. A NULL pointer must be rejected safely, never dereferenced.

Edge cases

• SameSite with no =value (bare SameSite or SameSite=) is NOT hardened — reject it.
• Attribute names embedded inside other tokens (e.g. SecureHttpOnlySameSite=1) must not count as the real flags.
• Empty string and NULL both return 0.

Example

• is_secure_cookie(hardened) -> 1
• is_secure_cookie(no_samesite) -> 0

Input format

A single NUL-terminated C string set_cookie holding the value of one Set-Cookie header (may be empty; the pointer may be NULL). Attributes are separated by ';' and may have surrounding spaces.

Output format

Return int 1 if the header sets Secure, HttpOnly, and a valued SameSite attribute; otherwise return 0.

Constraints

C11, single function, no I/O and no allocation. Do not dereference a NULL pointer. Only read the provided buffer up to its terminating NUL; never read past it. Attribute-name matching is case-insensitive.

Starter code

int is_secure_cookie(const char *set_cookie){
    /* TODO: audit the Set-Cookie header for Secure, HttpOnly, and SameSite.
       Placeholder trusts every cookie — replace this. */
    (void)set_cookie;
    return 1;
}

Common mistakes

Using strstr("Secure") which matches Secureish and substrings anywhere; forgetting SameSite needs an actual value; case-sensitive comparison that misses httponly; dereferencing a NULL header; approving when only one or two flags are present (failing to deny by default).

Edge cases to handle

NULL pointer -> 0; empty string -> 0; bare SameSite or SameSite= (no value) -> 0; flag names embedded in a larger token must not match; leading/trailing whitespace around attributes; lowercase or mixed-case attribute names must still match.

Background lessons

• Cookies, sessions, and browser storage