Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web>

I want to know if this change is setting the cookie as secure for sure. How can i check that ?

share|improve this question
add comment

2 Answers

Easiest route is to use a traffic interceptor, such as burp proxy, which lets you read cookie parameters. There are various other proxies which will do this as well.

This OWASP page has further information:

https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)

share|improve this answer
    
Thank you Rory. –  Vaishnavi Feb 25 '13 at 8:31
add comment

Another easy solution in addition to using tools like Burp proxy, is to use something like the "Advanced cookie manager" extension in firefox

This add on will show you a number of cookie parameters set for each cookie (for each site) as shown below:

enter image description here

Simply clear the cookies, attempt to access the site and see if the cookies are set correctly. In addition, you are able to make changes to any cookie properties (or add/delete specific items) at will. There are similar tools for other browsers like Chrome.

In addition, it certainly worth reading through the OWASP guide which provides a great deal of useful information when it comes to cookie security.

Hope that helps!

Cheers,

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.