IBM AppScan Security Scan: Cryptographic session (SSL) Cookie Missing Secure attribute handling method

Problem Description:

  cause Analysis:The secure attribute of the cookie should be set to True when HTTPS is turned on by the server;  Workaround:1. Server configuration HTTPS SSL mode, reference: HTTPS://SUPPORT.MICROSOFT.COM/KB/324069/ZH-CN2. Modify the Web. config to add:<system.web>

<system.web>see:http://msdn.microsoft.com/en-us/library/ms228262 (v=vs.100). aspx3. Modify the settings cookie when writing cookies in the background. Secure = true:HttpResponse response = HttpContext.Current.Response;var cookie = new HttpCookie (key, value);cookies. HttpOnly = true;cookies. Path = "/";cookies. Expires = DateTime.Now.AddHours (1);cookies. Secure = true; Response. AppendCookie (cookie);

IBM AppScan Security Scan: Cryptographic session (SSL) Cookie Missing Secure attribute handling method