App 1 — Cookie Setter

Sets cookies with Domain=.dev.advice.ers.nhs.uk to test cross-subdomain sharing.

poc_session (HttpOnly): Not set
poc_client (JS-accessible): Not set
Set Cookies Clear Cookies Go to App 2 →

Cookie Attributes Used

Attributepoc_sessionpoc_client
Domain.dev.advice.ers.nhs.uk.dev.advice.ers.nhs.uk
Path//
SecureYesYes
HttpOnlyYesNo
SameSiteLaxLax
Max-Age3600s3600s

Client-Side Check

document.cookie:

HttpOnly cookies are invisible to JavaScript — this is expected and demonstrates the protection.