title: How can I set the 'secure' flag for cookies in an ASP.NET MVC website?
body: <p>I have set the following in web.config:</p>
  
  <pre><code>&lt;system.web&gt;
    &lt;httpCookies httpOnlyCookies="true" requireSSL="true" /&gt;
  &lt;/system.web&gt;
  </code></pre>
  
  <p>When I hit the website using an HTTP connection, it redirects to my login page (specifying the scheme as HTTPS). When the browser fetches this page, the response sets some cookies (the ASP.NET session cookie, and the request verification token for my login form):</p>
  
  <blockquote>
    <p>Set-Cookie: __RequestVerificationToken=IHx8a2zQU374d5CtsoEVW...YtIc1; path=/; HttpOnly
    Set-Cookie: ASP.NET_SessionId=pfbkkxx2seqhdrxxiodxfbmh; path=/; HttpOnly</p>
  </blockquote>
  
  <p>These have the <code>HttpOnly</code> flag, which is good - but they do NOT have the <code>secure</code> flag as described <a href="https://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly" rel="noreferrer">here on Wikipedia</a>.</p>
  
  <p>If I then log in, an authentication cookie is created, and this <em>does</em> have the <code>secure</code> flag set:</p>
  
  <blockquote>
    <p>Set-Cookie:MyWebSite.Authentication=RE3UD...BDW4; path=/; <strong>secure</strong>; HttpOnly</p>
  </blockquote>
  
  <p>How can I ensure that the <code>secure</code> flag is set on <em>all</em> my cookies?</p>
  
  <hr>
  
  <p><strong>UPDATE</strong>: as requested, this is the cURL output I get (when fetching the login page directly):</p>
  
  <pre><code>curl https://www.mywebsite.com/Account/Login --verbose --insecure
  </code></pre>
  
  <p>gives:</p>
  
  <pre><code>  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  *   Trying 194.73.98.116...
  * Connected to www.mywebsite.com (111.11.11.111) port 443 (#0)
  * ALPN, offering http/1.1
  * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
  * TLSv1.2 (OUT), TLS header, Certificate Status (22):
  } [5 bytes data]
  * TLSv1.2 (OUT), TLS handshake, Client hello (1):
  } [512 bytes data]
  * TLSv1.2 (IN), TLS handshake, Server hello (2):
  { [85 bytes data]
  * TLSv1.2 (IN), TLS handshake, Certificate (11):
  { [2618 bytes data]
  * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
  { [401 bytes data]
  * TLSv1.2 (IN), TLS handshake, Server finished (14):
  { [4 bytes data]
  * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
  } [138 bytes data]
  * TLSv1.2 (OUT), TLS change cipher, Client hello (1):
  } [1 bytes data]
  * TLSv1.2 (OUT), TLS handshake, Finished (20):
  } [16 bytes data]
  * TLSv1.2 (IN), TLS change cipher, Client hello (1):
  { [1 bytes data]
  * TLSv1.2 (IN), TLS handshake, Finished (20):
  { [16 bytes data]
  * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-SHA384
  * ALPN, server did not agree to a protocol
  * Server certificate:
  *    subject: OU=Domain Control Validated; CN=*.mywebsite.com
  *    start date: 2015-07-29 13:37:38 GMT
  *    expire date: 2018-07-29 13:37:38 GMT
  *    issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
  *    SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
  } [5 bytes data]
  &gt; GET /Account/Login HTTP/1.1
  &gt; Host: www.mywebsite.com
  &gt; User-Agent: curl/7.43.0
  &gt; Accept: */*
  &gt; 
  { [5 bytes data]
  &lt; HTTP/1.1 200 OK
  &lt; Cache-Control: no-cache, no-store, must-revalidate
  &lt; Pragma: no-cache
  &lt; Content-Type: text/html; charset=utf-8
  &lt; Expires: -1
  &lt; Server: Microsoft-IIS/8.5
  &lt; Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
  &lt; X-Frame-Options: Deny
  &lt; X-Content-Type-Options: nosniff
  &lt; X-XSS-Protection: 1; mode=block
  &lt; Content-Security-Policy: default-src 'self';script-src 'self' www.google-analytics.com www.googletagmanager.com;object-src 'none';style-src 'self' fonts.googleapis.com;img-src 'self' www.google-analytics.com placehold.it placeholdit.imgix.net data:;media-src 'none';frame-src 'none';font-src 'self' fonts.gstatic.com;connect-src 'self';base-uri 'self';child-src 'none';frame-ancestors 'none';report-uri /WebResource.axd?cspReport=true
  &lt; X-Frame-Options: SAMEORIGIN
  &lt; X-Frame-Options: SAMEORIGIN
  &lt; Set-Cookie: __RequestVerificationToken=bPWxIp8e4F4I0Jt26t5oZyvDM6059tAWSRbgc-b6Df5IMjyYFDD9fJKgRsKVjbtN3EGgtFuHcf1sTjlYSwDWgnlhSUuNW1q5yv3cGMxmEwE1; path=/; HttpOnly
  &lt; Date: Fri, 04 Dec 2015 10:03:35 GMT
  &lt; Content-Length: 12596
  &lt; 
  { [12596 bytes data]
  100 12596  100 12596    0     0  31101      0 --:--:-- --:--:-- --:--:-- 31101
  * Connection #0 to host www.mywebsite.com left intact
  </code></pre>