ASP.NET: Failure To Require SSL For Authentication Cookies

Description

You can require the forms authentication cookie from your Web-based applications to use SSL. By setting the requireSSL attribute of the <forms> element to true, ASP.NET applications will use a secure connection when transmitting the authentication cookies to the Web server.

Remediation

To require SSL for authentication cookies, set the value of the <strong>requireSSL</strong> attribute of the &lt;forms&gt; element to <strong>true</strong>.<br/><br/>Example: &lt;forms requireSSL=&quot;true&quot;&gt;

References

Related Vulnerabilities