Secure session cookies in ASP.NET over HTTPS

Question

I got a little curious after reading this /. article over hijacking HTTPS cookies. I tracked it down a bit, and a good resource I stumbled across lists a few ways to secure cookies here . Must I use adsutil, or will setting requireSSL in the httpCookies section of web.config cover session cookies in addition to all others ( covered here )? Is there anything else I should be considering to harden sessions further?

Answer 1

用于控制它的web.config设置进入System.Web元素，如下所示：

<httpCookies httpOnlyCookies="true" requireSSL="true" />

Answer 2

https://www.isecpartners.com/media/12009/web-session-management.pdf

A 19 page white paper on "Secure Session Management with Cookies for Web Applications"

They cover lots of security issues that I haven't seen all in one spot before. It's worth a read.