Databases
StackOverflow2013
Postsdbo
POSessionAuthenticationModule Cookie Handler not creating HttpOnly secure cookie
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSessionAuthenticationModule Cookie Handler not creating HttpOnly secure cookie
    text
    copied!<p>I am using System.IdentityModel to authenticate users in an ASP.NET MVC4 web application using forms auth with a claims principal. (code based on this article: <a href="http://brockallen.com/2013/01/26/replacing-forms-authentication-with-wifs-session-authentication-module-sam-to-enable-claims-aware-identity/" rel="noreferrer">http://brockallen.com/2013/01/26/replacing-forms-authentication-with-wifs-session-authentication-module-sam-to-enable-claims-aware-identity/</a>)</p> <p>My ClaimsBasedAuthenticationService class issues the SAM cookie from the SessionSecurityToken, and all has been well...except that I just now noticed that it is not creating the session cookies as HTTPOnly or requiring them to require SSL. When I debug the code, I can see those properties on the CookieHandler object are set correctly in the debugger, but the final session cookie that is created simply doesn't have the HTTPOnly and Secure flags marked.</p> <p>I have the web.config lines to set these to true explicitly as such:</p> <pre><code>&lt;system.web&gt; &lt;httpCookies httpOnlyCookies="true" requireSSL="true" /&gt; &lt;authentication mode="Forms"&gt; &lt;forms ... requireSSL="true" /&gt; &lt;/authentication&gt; ... &lt;/system.web&gt; &lt;system.identityModel.services&gt; &lt;federationConfiguration&gt; &lt;cookieHandler requireSsl="true" hideFromScript="true" /&gt; &lt;/federationConfiguration&gt; &lt;/system.identityModel.services&gt; </code></pre> <p>Can someone tell me if there's something else I am missing in order for my FedAuth cookies to be hidden from script (HTTPOnly) and require SSL?</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload