Funny how just ran into a website that shows this...

http://ntsecurity.win2000mag-asap.com/info/com.duke_ntsecure_15940_15940.htm
l?se=ink

-----Original Message-----
From: Ken Schaefer [mailto:ken@a...]
Sent: Thursday, March 15, 2001 5:44 PM
To: Security_asp
Subject: Re: Secure Cookies



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
: The Netscape documentation says:
: SECURE specifies that the cookie is transmitted only if the
: communications channel with the host is a secure.
:
: Does this really work?
: Are there any known issues?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Argh - didn't we just have a huge long discussion about this? I think the MS
security bulletin that refers to the bug in IIS was posted 2 or 3
times...look in the archives - there is an issue whereby a secure cookie
could be sent over an insecure channel if the user moves from SSL to non-SSL

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
: Will asp allow a you to inadvertently set a secure cookie over a non
secure
: connection?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

See above.

Cheers
ken