We are using Sitecore 8.2 and We are doing the pen test and reports showing ASP.NET_SessionId is not enabled as a secure.

I had tried the below things in web.config file but this is not working properly.

<httpCookies requireSSL="true" /> 

And in <forms> set requireSSL too.

<forms name=".ASPXAUTH" cookieless="UseCookies" requireSSL="true" />

Is there any other possible way to change the SSL true for the cookies?

  • Are you sure you applied them in the right place in web.config? Setting like that works for me: <system.web> <httpCookies requireSSL="true" /> <authentication> <forms requireSSL="true" ... </authentication>
    – Marek Musielak
    Aug 8 at 6:48
  • No for me it is not working. It is not applied Aug 8 at 7:03

2 Answers 2


Along with the approaches you have tried, as you mentioned in the question, I would suggest you add HTTPOnly flag as appropriate for your cookies too. Add this to your web.config file.

    <httpCookies httpOnlyCookies="true" requireSSL="true" />




Hope this will work.

  • Thanks Sumit, After adding the httpOnlyCookies="true" it is working. Aug 8 at 7:56

In the <system.web> element, add the following element:

<httpCookies requireSSL="true" />

However, if you have a <forms> element in your system.web\authentication block, then this will override the setting in httpCookies, setting it back to the default false.

In that case, you need to add the requireSSL="true" attribute to the forms element as well.

So you will end up with:

    <authentication mode="Forms">
        <forms requireSSL="true">
            <!-- forms content -->


Hope it helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.