diff --git a/tests/cookies/mod.rs b/tests/cookies/mod.rs
new file mode 100644
index 00000000..a342534a
--- /dev/null
+++ b/tests/cookies/mod.rs
@@ -0,0 +1,31 @@
+use crate::common::req_path;
+use actix_web::http::header::SET_COOKIE;
+
+async fn set_cookie_header(path: &str) -> String {
+    let resp = req_path(path).await.unwrap();
+    resp.headers()
+        .get(SET_COOKIE)
+        .unwrap_or_else(|| panic!("{path} should have sent a Set-Cookie header"))
+        .to_str()
+        .unwrap()
+        .to_owned()
+}
+
+#[actix_web::test]
+async fn cookies_are_http_only_secure_and_same_site_strict_by_default() {
+    let header = set_cookie_header("/tests/cookies/set_cookie_defaults.sql").await;
+    assert!(header.starts_with("session=abc123"), "{header}");
+    assert!(header.contains("HttpOnly"), "{header}");
+    assert!(header.contains("Secure"), "{header}");
+    assert!(header.contains("SameSite=Strict"), "{header}");
+    assert!(header.contains("Path=/"), "{header}");
+}
+
+#[actix_web::test]
+async fn zero_turns_off_a_cookie_protection() {
+    let header = set_cookie_header("/tests/cookies/set_cookie_opt_out.sql").await;
+    assert!(!header.contains("HttpOnly"), "{header}");
+    assert!(!header.contains("Secure"), "{header}");
+    assert!(header.contains("SameSite=Lax"), "{header}");
+    assert!(header.contains("Path=/admin"), "{header}");
+}
diff --git a/tests/cookies/set_cookie_defaults.sql b/tests/cookies/set_cookie_defaults.sql
new file mode 100644
index 00000000..8775dca8
--- /dev/null
+++ b/tests/cookies/set_cookie_defaults.sql
@@ -0,0 +1,2 @@
+select 'cookie' as component, 'session' as name, 'abc123' as value;
+select 'text' as component, 'ok' as contents;
diff --git a/tests/cookies/set_cookie_opt_out.sql b/tests/cookies/set_cookie_opt_out.sql
new file mode 100644
index 00000000..6484bcc7
--- /dev/null
+++ b/tests/cookies/set_cookie_opt_out.sql
@@ -0,0 +1,8 @@
+select 'cookie' as component,
+    'session' as name,
+    'abc123' as value,
+    0 as http_only,
+    0 as secure,
+    'lax' as same_site,
+    '/admin' as path;
+select 'text' as component, 'ok' as contents;
diff --git a/tests/mod.rs b/tests/mod.rs
index 2084e691..e0c0b99a 100644
--- a/tests/mod.rs
+++ b/tests/mod.rs
@@ -1,6 +1,7 @@
 mod basic;
 mod common;
 mod configuration_docs;
+mod cookies;
 mod core;
 mod data_formats;
 mod errors;