How can I set the Secure flag on an ASP.NET Session Cookie?

Question

How can I set the Secure flag on an ASP.NET Session Cookie, so that it will only be transmitted over HTTPS and never over plain HTTP?

Answer 1

Things get messy quickly if you are talking about checked-in code in an enterprise environment. We've found that the best approach is to have the web.Release.config contain the following:

That way, developers are not affected (running in Debug), and only servers that get Release builds are requiring cookies to be SSL.