When a cookie is protected with the secure attribute set to true it will not be send by the browser over an unencrypted HTTP
request and thus cannot be observed by an unauthorized person during a man-in-the-middle attack.
There is a risk if you answered yes to any of those questions.
HTTPs everywhere so setting the secure flag to true should be the default behaviour
when creating cookies. secure flag to true for session-cookies. When the HttpCookie.Secure property is set to false then the cookie will be send during an unencrypted HTTP request:
HttpCookie myCookie = new HttpCookie("Sensitive cookie");
myCookie.Secure = false; // Sensitive: a security-sensitive cookie is created with the secure flag set to false
The default value of
Secure flag is false, unless overwritten by an application’s configuration file:
HttpCookie myCookie = new HttpCookie("Sensitive cookie");
// Sensitive: a security-sensitive cookie is created with the secure flag not defined (by default set to false)
Set the HttpCookie.Secure property to true:
HttpCookie myCookie = new HttpCookie("Sensitive cookie");
myCookie.Secure = true; // Compliant
Or change the default flag values for the whole application by editing the Web.config configuration file:
<httpCookies httpOnlyCookies="true" requireSSL="true" />
requireSSL attribute corresponds programmatically to the Secure field. httpOnlyCookies attribute corresponds programmatically to the httpOnly field.