如何在 ASP.NET MVC 網站中為 cookie 設置“安全”標誌？

我在 web.config 中設置了以下內容：

<system.web>
 <httpCookies httpOnlyCookies="true" requireSSL="true" />
</system.web>

當我使用 HTTP 連接訪問網站時，它會重定向到我的登錄頁面（將方案指定為 HTTPS）。當瀏覽器獲取此頁面時，響應會設置一些 cookie（ASP.NET 會話 cookie 和我的登錄表單的請求驗證令牌）：

設置 Cookie：__RequestVerificationToken=IHx8a2zQU374d5CtsoEVW…YtIc1；路徑=/; HttpOnly 設置 Cookie：ASP.NET_SessionId=pfbkkxx2seqhdrxxiodxfbmh；路徑=/; HttpOnly

這些有HttpOnly標誌，這很好 - 但它們沒有Wikipedia 上secure描述的標誌。

如果我隨後登錄，則會創建一個身份驗證 cookie，並且確實設置了secure標誌：

設置 Cookie:MyWebSite.Authentication=RE3UD…BDW4; 路徑=/; 安全; HttpOnly

如何確保在我的所有cookiesecure上都設置了標誌？

---

更新：根據要求，這是我得到的 cURL 輸出（直接獲取登錄頁面時）：

curl https://www.mywebsite.com/Account/Login --verbose --insecure

給出：

 % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed
 0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
*   Trying 194.73.98.116...
* Connected to www.mywebsite.com (111.11.11.111) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [85 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2618 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [401 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [138 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*    subject: OU=Domain Control Validated; CN=*.mywebsite.com
*    start date: 2015-07-29 13:37:38 GMT
*    expire date: 2018-07-29 13:37:38 GMT
*    issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
*    SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
} [5 bytes data]
> GET /Account/Login HTTP/1.1
> Host: www.mywebsite.com
> User-Agent: curl/7.43.0
> Accept: */*
> 
{ [5 bytes data]
< HTTP/1.1 200 OK
< Cache-Control: no-cache, no-store, must-revalidate
< Pragma: no-cache
< Content-Type: text/html; charset=utf-8
< Expires: -1
< Server: Microsoft-IIS/8.5
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< X-Frame-Options: Deny
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Content-Security-Policy: default-src 'self';script-src 'self' www.google-analytics.com www.googletagmanager.com;object-src 'none';style-src 'self' fonts.googleapis.com;img-src 'self' www.google-analytics.com placehold.it placeholdit.imgix.net data:;media-src 'none';frame-src 'none';font-src 'self' fonts.gstatic.com;connect-src 'self';base-uri 'self';child-src 'none';frame-ancestors 'none';report-uri /WebResource.axd?cspReport=true
< X-Frame-Options: SAMEORIGIN
< X-Frame-Options: SAMEORIGIN
< Set-Cookie: __RequestVerificationToken=bPWxIp8e4F4I0Jt26t5oZyvDM6059tAWSRbgc-b6Df5IMjyYFDD9fJKgRsKVjbtN3EGgtFuHcf1sTjlYSwDWgnlhSUuNW1q5yv3cGMxmEwE1; path=/; HttpOnly
< Date: Fri, 04 Dec 2015 10:03:35 GMT
< Content-Length: 12596
< 
{ [12596 bytes data]
100 12596  100 12596    0     0  31101      0 --:--:-- --:--:-- --:--:-- 31101
* Connection #0 to host www.mywebsite.com left intact

建議的解決方法是在處理頁面請求時保護會話 ID 和表單請求 cookie，例如

// This code will mark the forms authentication cookie and the
// session cookie as Secure.
if (Response.Cookies.Count > 0)
{
   foreach (string s in Response.Cookies.AllKeys)
   {
       if (s == FormsAuthentication.FormsCookieName || s.ToLower() == "asp.net_sessionid")
       {
            Response.Cookies[s].Secure = true;
       }
   }
}

以及 webconfig 中用於保護表單身份驗證令牌的附加行：

<authentication mode="Forms">
  <forms ...  requireSSL="true" />
</authentication>

2020 - 編輯：

根據評論中的要求，也可以僅使用 IIS 重寫規則來配置它，方法是檢查 cookie 中的安全標誌並在未找到時添加它，例如：

<system.webServer>
 <rewrite>
   <outboundRules>
     <rule name="Use only secure cookies" preCondition="Unsecured cookie">
       <match serverVariable="RESPONSE_SET_COOKIE" pattern=".*" negate="false" />
       <action type="Rewrite" value="{R:0}; secure" />
     </rule>
     <preConditions>
       <preCondition name="Unsecured cookie">
         <add input="{RESPONSE_SET_COOKIE}" pattern="." />
         <add input="{RESPONSE_SET_COOKIE}" pattern="; secure" negate="true" />
       </preCondition>
     </preConditions>
   </outboundRules>
 </rewrite>
...
</system.webServer>

資料來源： 保護請求-響應 cookie -通過 Web.config 保護表單身份驗證-如何在 IIS 中啟用安全 HttpOnly Cookie

引用自：https://stackoverflow.com/questions/32604933