search

h5bp / server-configs-iis

IIS Web.Config Boilerplates
MIT License
336 stars 85 forks source link

Added httpCookies config #5

Closed curtisk closed 11 years ago

curtisk commented 11 years ago

Added httpCookies config which covers setting HttpOnly flag, toggle requiring SSL for cookies and setting domain for cookies

https://www.owasp.org/index.php/HttpOnly

ChrisMcKee commented 11 years ago

I'd considered adding this previously but wavered on the possible issues it may cause. On second thoughts though Ta :)

curtisk commented 11 years ago

...the possible issues it may cause.

That's what nice about this boilerplate, it shows you whats available, gives a short explanation as to how/why, you can always opt to remove or comment out on your own deployment if it doesn't fit your use

@ChrisMcKee you want this setting written up and added to doc/README.md as well?

ChrisMcKee commented 11 years ago

Please. Originally the BP contained just the web.server stuff (in keeping with the other configs); I added in the other bits / security headers / config to cover the rest. You do have to consider the people that will inevitably just copy and paste the lot without thinking about it or reading it though :)