Important Notice from AspDotNetStorefront
It is with dismay that we report that we have been forced, through the action of hackers, to shut off write-access to this forum. We are keen to leave the wealth of material available to you for research. We have opened a new forum from which our community of users can seek help, support and advice from us and from each other. To post a new question to our community, please visit: http://forums.vortx.com
Results 1 to 5 of 5

Thread: Cookies over SSL

  1. 07-06-2011, 06:24 AM #1
    msthompson is offline Junior Member
    Join Date
    Jul 2011
    Posts
    5

    Default Cookies over SSL

    Hello,

    My customer requires that cookies be sent via SSL to pass the McAfee security scan.

    This is what I have done so far:

    Modified the forms authentication tag in the web.config file, added requireSSL="true".
    Modified SetCookie function in applogic.cs, added cookie.Secure = true;
    Modified SetSessionCookie function in applogic.cs, added cookie.Secure = true;

    Thus far, these settings have not been enough to flag the cookie as secure. I am still working on this, however, if anyone has already implemented it, I would appreciate any information about additional steps.

    I am using version 9.

    Thank you,
    M. Thompson
  2. 07-06-2011, 09:25 AM #2
    ssgumby is offline Senior Member
    Join Date
    Feb 2009
    Posts
    683

    Default

    The mcafee security scan will pass with non-secured cookies, you just need to explain to them that there is no sensitive information contained in the cookies and that the cookie is used only to make a better shopping experience.
  3. 07-06-2011, 01:53 PM #3
    msthompson is offline Junior Member
    Join Date
    Jul 2011
    Posts
    5

    Default

    I have explained this to my customer. They do not consider that an acceptable solution.

    The customer considers the cookies being secure a go live requirement even though it is a low level security flag and no sensitive information is passed.
    Last edited by msthompson; 07-06-2011 at 02:05 PM.
  4. 07-07-2011, 09:42 AM #4
    ssgumby is offline Senior Member
    Join Date
    Feb 2009
    Posts
    683

    Default

    Unless im wrong, and I dont think I am, setting the cookies as secure would mean the entire site would have to run on https as a secure cookie written wont be read on http.
  5. 03-20-2012, 08:01 AM #5
    lsegura is offline Junior Member
    Join Date
    Mar 2012
    Posts
    1

    Default Cookies over SSL

    Hi,

    Our PCI scan is also failing because the ASPDNSFGUID cookie is not marked as secure. I have added this to the web.config - <httpCookies httpOnlyCookies="true" requireSSL="true" lockItem="true" /> - and it secures all the cookies except ASPDNSFGUID. The site runs in https.

    Lisa