Setting the Secure Cookie Attribute and HttpOnly flag on cookies

Secure Cookie Attribute:

The secure attribute is an option that can be set by the application server when sending a new cookie to the user within an HTTP Response. The purpose of the secure attribute is to prevent cookies from being observed by unauthorized parties due to the transmission of the cookie in clear text. To accomplish this goal, browsers which support the secure attribute will only send cookies with the secure attribute when the request is going to an HTTPS page. Said in another way, the browser will not send a cookie with the secure attribute set over an unencrypted HTTP request. By setting the secure attribute, the browser will prevent the transmission of a cookie over an unencrypted channel.

Solution for Opti 12:

In the Startup.cs add

app.UseCookiePolicy(new CookiePolicyOptions
{
    Secure = CookieSecurePolicy.Always
});

Solution for Opti 11:

In the web.config add

<httpCookies requireSSL="true" />

Set Cookie to be HttpOnly:

When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These cookies include, but are not limited to, CSRF tokens and client sessions that can make it easier to achieve account/session takeover.

Solution for Opti 12:

app.UseCookiePolicy(new CookiePolicyOptions
{
      HttpOnly = HttpOnlyPolicy.Always
});

Solution for Opti 11:

In the web.config add

<httpCookies httpOnlyCookies="true"/>