ASP.NET Securing Cookie on HTTP and HTTPS

Question

I have a site that has both HTTP and HTTPS pages.

I have tried the following to make cookies secure:

• Web.config <httpCookies requireSSL="true" /> with form authentication.
• Forcing cookie to secure at Application_End

In both case pages don't work with HTTP. I think above solution only works if all the pages use HTTPS.

How to resolved this puzzle?

Answer 1

The whole point of a cookie set as 'secure' is that it is only transmitted over https; the http pages will not receive a copy of it. From Wikipedia:

A secure cookie has the secure attribute enabled and is only used via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. This makes the cookie less likely to be exposed to cookie theft via eavesdropping.

If you want to use a secure cookie, you need to ensure that all the pages use https.