1

I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web>

I want to know if this change is setting the cookie as secure for sure. How can i check that ?

3

Easiest route is to use a traffic interceptor, such as burp proxy, which lets you read cookie parameters. There are various other proxies which will do this as well.

This OWASP page has further information:

https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)

2

Another easy solution in addition to using tools like Burp proxy, is to use something like the "Advanced cookie manager" extension in firefox

This add on will show you a number of cookie parameters set for each cookie (for each site) as shown below:

enter image description here

Simply clear the cookies, attempt to access the site and see if the cookies are set correctly. In addition, you are able to make changes to any cookie properties (or add/delete specific items) at will. There are similar tools for other browsers like Chrome.

In addition, it certainly worth reading through the OWASP guide which provides a great deal of useful information when it comes to cookie security.

Hope that helps!

Cheers,

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.