Hello all,
I'm not really sure if this should fall under the IIS.net forum, but i had a similar issue where i needed to update the Metabase.xml so it might be a similar fix.
Basically, this is the final thing that's been flagged in a vulnerability scan and needs fixing ASAP, so any help is hugely appreciated.
I need to know how to set HTTPONLY on the ASPSESSION cookie created by default from ASP & IIS. This is the cookie is automatically created by the server for all asp pages. The issue i had before was to do with setting the cookie as secure because this is running through https.
If needed i can set HTTPONLY on all cookie across the site.
Any help on how to do this would be massively appreciated.
Thanks a lot,
Elliott
I'm not really sure if this should fall under the IIS.net forum, but i had a similar issue where i needed to update the Metabase.xml so it might be a similar fix.
Basically, this is the final thing that's been flagged in a vulnerability scan and needs fixing ASAP, so any help is hugely appreciated.
I need to know how to set HTTPONLY on the ASPSESSION cookie created by default from ASP & IIS. This is the cookie is automatically created by the server for all asp pages. The issue i had before was to do with setting the cookie as secure because this is running through https.
If needed i can set HTTPONLY on all cookie across the site.
Any help on how to do this would be massively appreciated.
Thanks a lot,
Elliott