Author: LearningSecurity | Posted on: 3/28/2006 12:17:32 PM | Views : 385

Hi,

In ASP.NET 2.0,  httpOnly attribute is turned on by default :
Set-Cookie: ASP.NET_SessionId=aabbffvvdd; path=/; HttpOnly

and I can't find a way to turn if off. I am using a trusted 3rd party application that gives errors because of that flag, so I wanted to disable that flag to do some testing. Is there any way to turn it off using ASP 2.0?

I tried suggestion mentioned in http://www.hanselman.com/blog/HttpOnlyCookiesOnASPNET11.aspx, but web.config didn't help.
Also, as far as I know, there is no Global.aspx in ASP.NET 2.0.

Thanks!
...

Go to the complete details ...