Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web>

I want to know if this change is setting the cookie as secure for sure. How can i check that ?

share|improve this question

Easiest route is to use a traffic interceptor, such as burp proxy, which lets you read cookie parameters. There are various other proxies which will do this as well.

This OWASP page has further information:

share|improve this answer
Thank you Rory. – Vaishnavi Feb 25 '13 at 8:31

Another easy solution in addition to using tools like Burp proxy, is to use something like the "Advanced cookie manager" extension in firefox

This add on will show you a number of cookie parameters set for each cookie (for each site) as shown below:

enter image description here

Simply clear the cookies, attempt to access the site and see if the cookies are set correctly. In addition, you are able to make changes to any cookie properties (or add/delete specific items) at will. There are similar tools for other browsers like Chrome.

In addition, it certainly worth reading through the OWASP guide which provides a great deal of useful information when it comes to cookie security.

Hope that helps!


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.