Secure Flag for ASPXAUTH Cookie

Question

We have an externally facing application which was penetration-tested by an external security company. Application has been developed on ASP.NET MVC4 and running on IIS8/Windows

Answer 1

Your issue looks to be that because your form is incorrectly configured. You have:

and you should have

According to Microsoft the requireSSL attribute in the httpCookies tag is overridden by the requireSSL attribute of the forms tag. You didn't set the value, but you specified it may cause IIS to use the default of false. You should set it to true.