Is it possible to mark the cookie ASP.NET_sessionID as secure

Question

After a security audit I got the requirement to set the cookie ASP.NET_sessionID as "secure".

Right now the flag is not set.

Can I use SessionIDManager to set it as secure? I am already using it to change the value of the Session cookie after logging in with this code:

            System.Web.SessionState.SessionIDManager manager = new System.Web.SessionState.SessionIDManager();
            string oldId = manager.GetSessionID(System.Web.HttpContext.Current);
            string newId = manager.CreateSessionID(System.Web.HttpContext.Current);
            bool isAdd = false, isRedir = false;
            manager.SaveSessionID(System.Web.HttpContext.Current, newId, out isRedir, out isAdd);

EDIT

I saw that I can set

<httpCookies httpOnlyCookies="false" requireSSL="true" />

But I only want to have this one cookie secure

Related question https://stackoverflow.com/questions/38954821/preventing-csrf-with-the-same-site-cookie-attribute/ (has answer about ASP session too) — Alex from Jitbit, Sep 08 '19 at 09:05

score 5 · Answer 1 · answered Apr 08 '14 at 13:34

5

Simply write the code for pass security audit.

void Session_Start(Object sender, EventArgs e)
    {

        if (Request.IsSecureConnection)
            {
                Response.Cookies["ASP.NET_SessionId"].Secure = true;
            }

    }

answered Apr 08 '14 at 13:34

Alagappapillai

51
1
1

martin308 · Accepted Answer · 2013-10-02T03:01:55.957

4

This should enable you to set the cookie as secure:

void Application_EndRequest(object sender, EventArgs e)
{
    var sessionCookieKey = Response.Cookies.AllKeys.SingleOrDefault(c => c.ToLower() == "asp.net_sessionid");
    var sessionCookie = Response.Cookies.Get(sessionCookieKey);
    if(sessionCookie != null)
    {
        sessionCookie.Secure = true;
    }
}

edited Oct 02 '13 at 03:01

answered Aug 30 '12 at 23:39

martin308

706
6
20

Where is `Application_EndRequest`? My `Global.asax` has only `Session_End` and `Application_End`. – Blaise May 15 '13 at 18:47
Just add it to your Global.asax file and you should be good to go – martin308 May 16 '13 at 01:23
I updated the sample, you need to retrieve the cookie and not just the key to the cookie – martin308 Oct 02 '13 at 03:02
I think session cookie should be done in Session_Start as @Alagappapillai suggested. – Rahatur Feb 12 '19 at 05:59

Is it possible to mark the cookie ASP.NET_sessionID as secure

2 Answers2

Linked