title: How to add to Azure Session Cookies HttpOnly and Secure attributes
body: <p>In my ASP.NET MVC 4 application I use a third-party service. And one of the service's terms of use is adding to all session cookies HttpOnly and Secure attributes.</p>
  
  <p>WebSite hosted on Windows Azure and works on SSL.</p>
  
  <p>I added to root web.config the following settings:</p>
  
  <pre><code>&lt;httpCookies httpOnlyCookies="true" requireSSL="true" lockItem="true"/&gt;
  
  &lt;authentication mode="Forms"&gt;
      &lt;forms loginUrl="~" timeout="2880" requireSSL="true" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>So now my application session cookie ".ASPXAUTH" has HttpOnly and Secure attributes.</p>
  
  <p>But the main problem that Azure Balancer "WAWebSiteSID" and "ARRAffinity" cookies  don't have this attributes.</p>
  
  <p>Could you help me to find appropriate solution to add missing attributes to them?</p>