title: trying to ensure 'cookies' are set with httpOnly attribute in IIS
body: <p>I am trying to ensure 'cookies' are set with httpOnly attribute in IIS, which from reading hundreds of articles it seems is simple but why does my security scan keep failing.</p>
  
  <p>I have added <code>&lt;httpCookies httpOnlyCookies="true" requireSSL="true" /&gt;</code> to the system.web section of the web config but still it fails so what am I missing ? </p>
  
  <p>I am running IIS 8 on W2012 R2 with .net 4 in the application pool ?</p>
  
  <p>Any help is greatly appreciated as I have spent hours going round in circles on this !</p>
  
  <p>Thanks </p>