How to make the ASP.NET_SessionId cookies id as a secure

Question

We are using Sitecore 8.2 and We are doing the pen test and reports showing ASP.NET_SessionId is not enabled as a secure.

I had tried the below things in web.config file but this is not working properly.

<httpCookies requireSSL="true" /> 

And in <forms> set requireSSL too.

<forms name=".ASPXAUTH" cookieless="UseCookies" requireSSL="true" />

Is there any other possible way to change the SSL true for the cookies?

Answer 1

Along with the approaches you have tried, as you mentioned in the question, I would suggest you add HTTPOnly flag as appropriate for your cookies too. Add this to your web.config file.

<system.web>
    ...
    <httpCookies httpOnlyCookies="true" requireSSL="true" />
    ...
</system.web>

References:

https://andrewwburns.com/2016/10/21/secure-your-sitecore-cookies/

https://learn.microsoft.com/en-us/answers/questions/179172/implement-domain-http-only-and-secure-cookie-attri

Hope this will work.

Answer 2

In the <system.web> element, add the following element:

<httpCookies requireSSL="true" />

However, if you have a <forms> element in your system.web\authentication block, then this will override the setting in httpCookies, setting it back to the default false.

In that case, you need to add the requireSSL="true" attribute to the forms element as well.

So you will end up with:

<system.web>
    <authentication mode="Forms">
        <forms requireSSL="true">
            <!-- forms content -->
        </forms>
    </authentication>
</system.web>

References

• httpCookies Element (ASP.NET Settings Schema)

• FormsAuthentication.RequireSSL Property

Hope it helps!