ASP.Net MVC: cookie does not contain HttpOnly attribute and Secured attribute vulnerability

Hi tsakumar81,

Are you using forms authentication?

If you have a forms element then, you need to add the requireSSL attribute to true in the forms element as well.

<system.web>
  <httpCookies httpOnlyCookies="true" requireSSL="true" />
  <authentication mode="Forms">
    <forms requireSSL="true">
    </forms>
  </authentication>
</system.web>

we use windows authentixation, please let me know if requireSSL can be applied for it.