title: asp.net secure cookies
body: <p>I want to secure my cookies, i read about "HTTPOnly" and "Secure" cookie flags for the ASP.NET_SessionId cookie.
  I create new asp.net project in VS. And in fiddler in Inspectors -> raw i have:</p>
  
  <pre><code>Cookie: DXCurrentThemeMVC=Office2010Black; ASP.NET_SessionId=1gq0t1mi234xyljqnxrzbqfx
  </code></pre>
  
  <p>Then i modify  web.config :</p>
  
  <pre><code>&lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.0" /&gt;
  
      &lt;httpCookies httpOnlyCookies="true" requireSSL="true"/&gt;
  
      &lt;authentication mode="Forms"&gt;
        &lt;forms loginUrl="~/Account/Login.aspx" timeout="2880" requireSSL="true" /&gt;
      &lt;/authentication&gt;
  </code></pre>
  
  <p>But in fiddler the same data</p>
  
  <pre><code> Cookie: DXCurrentThemeMVC=Office2010Black; ASP.NET_SessionId=1gq0t1mi234xyljqnxrzbqfx
  </code></pre>
  
  <p>I think when i add
   <code>&lt;httpCookies httpOnlyCookies="true" requireSSL="true"/&gt;</code> 
  i cant see cookies in fiddler, or cookies will be encrypted. Is this  correct result ? Or i have mistake somewhere?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>and why i dont see in fiddler </p>
  
  <pre><code>Set-Cookie: ASP.NET_SessionId=ig2fac55; path=/; secure; HttpOnly
  </code></pre>
  
  <p>but only cookie without set-, and secure, and HttpOnly also in firebug i see the same results</p>
  
  <p><strong>EDIT2</strong>
  It seems like i find my problem: i host app on iis and in firebug look for cookies, and i have cookies with secure and httpOnly Flags:</p>
  
  <pre><code>ASP.NET_SessionId=98sfd90sdf89sd0f80s8; path=/; secure; HttpOnly
  </code></pre>