ASP.NET 中的安全 Cookie

Question

I am still a little new to ASP.Net and am beginning to work with cookies. I have a somewhat understanding of them and was wondering something about them.

This is in regards to securing cookies. I have httpOnlyCookies set to true as seen below.

<httpCookies httpOnlyCookies="true"/>

I noticed there was a Cookie.Secure property which I enabled as true. I did research on these two but am having trouble understanding the differences between the two. Can someone provide some direction on this? What would happen if I kept both set to true? What else can I do to secure cookies other than using SSL?

Many Thanks!

Answer 1

httpOnlyCookies=true is a site wide web config setting that prevents client side scripts from accessing the cookies. The cookie is still transmitted regardless of how secure the channel is ie via both http and https .

Cookie.Secure tells the browser to only send the cookie if the channel is secure. ie https only .

So the former setting describes what can access the cookie. The latter configures its transmission security requirements.