We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool.
Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's developer tools, there are some cookies with Secure flag. But ASPXAUTH was not one of them.
Already I have included below line of code in Web.Config file.
Note : We are not using Forms Authentication for login.
What is the correct way to mark ASPXAUTH as secure?