What really? My security assessment failed because of my cookies. But I only use a couple of cookies to store certain user preferences. Those cookies are there only for user convince. Guess what? That third-party that ran the security assessment doesn’t care. All they care about is that you have cookies and that you are not securing your cookies properly.
You can easily pass your security assessment by opening Web.Config and setting the http Only setting to true and also turning on SSL for your cookies (assuming you only have SSL);
<httpCookies httpOnlyCookies=”true” requireSSL=”true” />
But you do need to understand the ramifications of these settings.
If your JavaScript is accessing your cookies then setting httpOnlyCookies to true will break your code. HttpOnly cookies help mitigate XSS and prevents cookies from being accessed vias client-side scripting. Therefore, depending on how your code is implemented may mean you have some refactoring to do.
Finally, my sites normally run using SSL only. Therefore, I set requireSSL to true. This only allows the cookie to be sent back over a connection using SSL/TLS. This is especially important with the Session Id cookie. You certainly do not want that to be passed over HTTP since that could be stolen and used to hack your site.
Doylestown Coder 