I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie.
The web application is written in .Net so I have added this content to web config:
<httpCookies requireSSL="true" />
After that I checked application in browser with the "Advanced Cookie Manager" add-on in Firefox.
Results of Advanced Cookie Manager: some attributes IsSecure values are true, some are false.
I want to check to see if this is a false positive - how else can I re-check secure attribute.