Secure flag not set to Cookies in .Net application

Question

I have included below lines of code in my Web.Config and Global.asax.cs file. Still when I use developer tools in browser I could see secure flag not set to the below Cookies.

Also Configured SSLSettings in my IIS(Selected checkbox requireSSL).

I would like to set Secure attribute to all Cookies not only to received but also to Sent cookies. Any suggestion please.

In Web.config:

<httpCookies requireSSL="true"/>

In Global.asax.cs:

protected void Application_EndRequest(object sender, EventArgs e)
{
    if (Request.IsSecureConnection == true && HttpContext.Current.Request.Url.Scheme == "https")
    {
        Request.Cookies["ASP.NET_SessionID"].Secure = true;
        if (Request.Cookies.Count > 0)
        {
            foreach (string s in Request.Cookies.AllKeys)
            {
                Request.Cookies[s].Secure = true;
            }
        }

        Response.Cookies["ASP.NET_SessionID"].Secure = true;
        if (Response.Cookies.Count > 0)
        {
            foreach (string s in Response.Cookies.AllKeys)
            {
                Response.Cookies[s].Secure = true;
            }
        }
    }
}

In Browser:

Try the same code in Application_BeginRequest or in Session_Start. — Tech Learner, Sep 15 '17 at 05:57
@G01 - I have used the code in Global.asax.cs file as you suggested. But same result. Any other way to set secure? — Tech Learner, Sep 15 '17 at 06:01
In Web.config file, check for lockItem or lockattribute. If so, remove and check it again in browser. — Tech Learner, Sep 15 '17 at 06:28
@G01 - I tried bot the options. Added and removed lockitem in HttpCookie but no luck. Still same result. — Tech Learner, Sep 15 '17 at 06:44
Please refer below URL. https://stackoverflow.com/questions/1442863/how-can-i-set-the-secure-flag-on-an-asp-net-session-cookie — Tech Learner, Sep 15 '17 at 08:49

score 0 · Answer 1 · answered Sep 15 '17 at 08:50

There are two ways, one httpCookies element in web.config allows you to turn on requireSSL which only transmit all cookies including session in SSL only and also inside forms authentication, but if you turn on SSL on httpcookies you must also turn it on inside forms configuration too.

<form>
<httpCookies requireSSL="true" />

Secure flag not set to Cookies in .Net application

1 Answers1