How is HttpOnly get set for ASP.NET_SessionId cookie?

Question

In my web project setting to turn on httpOnlyCookies is not there. It is false by default. Also there is no place in code where cookie is being set to HttpOnly. However, when I browse to the site I can see that ASP.NET_Session cookie is being passed as HttpOnly. How is it set to HttpOnly?

Caldwell

Answer 1

ASP.NET session cookies are HTTP only, regardless of the httpOnlyCookies setting linked to in your question, because this is burned into ASP.NET. You can't override this.

If you dig into the System.Web.SessionState.SessionIDManager class in the System.Web assembly the code for creating the ASP.NET session cookie looks like:

private static HttpCookie CreateSessionCookie(string id)
{
    HttpCookie cookie = new HttpCookie(Config.CookieName, id);
    cookie.Path = "/";
    cookie.HttpOnly = true;   // <-- burned in
    return cookie;
}

Thanksgiving

found documentation here: msdn.microsoft.com/en-us/library/aa480476.aspx "HttpOnly. This property specifies whether the cookie can be accessed by client script. In ASP.NET 2.0, this value is always set to true. " – Caldwell

@dev - I just dug into the System.Web.dll assembly to take a peek :) – Thanksgiving

The part right below it is important too. Older browsers do not support HttpOnly, and may either ignore the cookie or ignore the attribute, the latter still leaves your site open to XSS attacks. – Denman

I am confused. The documentatin at msdn.microsoft.com/en-us/library/… says that the default value is false: true if the cookie has the HttpOnly attribute and cannot be accessed through a client-side script; otherwise, false. The default is false. – Tanning

@Tanning - this question and answer is about session cookies, not regular cookies. Session cookies are always HTTP Only, that is burned into the framework code. – Thanksgiving

Thanks. That's cool. How do I set the secure flag on a cookie? I have <httpCookies httpOnlyCookies="true" requireSSL="true"/> in web.config, and even when I access my web app through https, I don't see the secure flag for the session cookie in firebug. – Tanning

@Tanning - see https://mcmap.net/q/143575/-how-can-i-set-the-secure-flag-on-an-asp-net-session-cookie (the answer with 54 upvotes). You'll not see anything special happen to the cookie (to the best of my knowledge), other than that the cookie will only be transmitted over SSL. – Thanksgiving

Thanks. I've read that thread at the link you gave. Are you saying that even with requireSSL="true" in web.config for httpCookies, we will not see in firebug the secure flag for the ASP.NET_SessionId cookie? – Tanning

@Tanning - I don't use Firebug so I've no idea. You can test this by seeing if your cookies arrive on a non-ssl connection. Sorry, not being much help here. I'm doing less .NET development these days so my memory is a bit vague. – Thanksgiving

Answer 2

It is HttpOnly so your session cookie cannot be modified by the client with JavaScript.

Diep

Correct. I knew that part. I rephrased my question from "why" to "how is it set?" – Caldwell