I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web>
I want to know if this change is setting the cookie as secure for sure. How can i check that ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Easiest route is to use a traffic interceptor, such as burp proxy, which lets you read cookie parameters. There are various other proxies which will do this as well.
This OWASP page has further information:
Another easy solution in addition to using tools like Burp proxy, is to use something like the "Advanced cookie manager" extension in firefox
This add on will show you a number of cookie parameters set for each cookie (for each site) as shown below:
Simply clear the cookies, attempt to access the site and see if the cookies are set correctly. In addition, you are able to make changes to any cookie properties (or add/delete specific items) at will. There are similar tools for other browsers like Chrome.
In addition, it certainly worth reading through the OWASP guide which provides a great deal of useful information when it comes to cookie security.
Hope that helps!