title: ASP.Net MVC5 set secure and HTTPOnly flags
body: <p>I need to set the <code>httponly</code> and the <code>secure</code> flag to all the cookies of my site to pass the security scans of my customer.
  The web.config is configured correctly I think</p>
  
  <pre><code>&lt;system.web&gt;
     &lt;httpCookies httpOnlyCookies="true" requireSSL="true" lockItem="true" /&gt;
  </code></pre>
  
  <p>And it is working for all the cookies I create inside my application, but not for google analitycs ones (I know I can not do anything about it) and what I suppose are the session cookies of asp.net (<code>ai_user</code> and <code>ai_session</code>).</p>
  
  <p><img src="https://i.stack.imgur.com/7fswj.jpg" alt="enter image description here"></p>
  
  <p>Searching for this two cookies lead to nothing.
  How can I force the <code>httponly</code> and <code>secure</code> flags?</p>
  
  <p>I do not know if it is related, but I have also this rewrite rule</p>
  
  <pre><code>&lt;rewrite&gt;      
    &lt;rules&gt;
      &lt;rule name="HTTP to HTTPS redirect" stopProcessing="true"&gt;
        &lt;match url="(.*)" /&gt;
        &lt;conditions&gt;
          &lt;add input="{HTTPS}" pattern="off" ignoreCase="true" /&gt;
        &lt;/conditions&gt;
        &lt;action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" /&gt;
      &lt;/rule&gt;
    &lt;/rules&gt;
  &lt;/rewrite&gt;
  </code></pre>
  
  <p>I tried to disable it, but nothing changed</p>