How to disable httpOnlyCookies - asp.net

Scenario

HTTP only cookies cannot be read by client-side script therefore marking a cookie as HTTP only can provide an additional layer of protection against cross-site script attack.

Impact:

During Cross-Site scripting attack and attacker might easily access cookies and hijack the victim’s session.

Solution

You can disable the httpOnlyCookies on the web.config file. Open the web.config file and add the configuration on the httpCookies element like example below :


<system.web>

:

:

<httpCookies httpOnlyCookies="false" requireSSL="false" domain="" />

:

:
 </system.web>




By
NOTE : – If You have Found this post Helpful, I will appreciate if you can Share it on Facebook, Twitter and Other Social Media Sites. Thanks =)

Popular posts from this blog

Example to disable save as certain file type in SSRS Report Viewer

Phone book application example - Java

Modal Popup Message Box ASP.NEt C# Example