Question

How read cookie values like expires, httponly, etc?

I know I can find all these information in Dev Tools/Resources/Cookies. I read about restrictions in accessing to cookies from JS.

I would like to create chrome extensions with JS which will tell me if the website violate my “default security level” during the time I’m using the website.
For example if the website change the session id while changing http to https, if it allow to send cookies also to subdomains and so on.

Thank you in advance for suggestions.

Answer 1

This is how you should read cookies, according to http://code.google.com/chrome/extensions/cookies.html#type-Cookie :

chrome.cookies.getAll({ url:... /* more options */ }, function(cks){
      console.log(cks); 
      for(var i=0; i<cks.length; i++){
             console.log(cks[i].name, cks[i].secure, cks[i].httpOnly); // ...
      }
}); 

chrome.cookies.getAll has a callback parameter which gets passed an array full of cookie objects. Iterate those objects and you should be able to get their props, make comparisons, etc.

Make sure you have proper permissions put in manifest file although errors should guide you through.