title: Classic ASP: How to check if ASPSESSIONID* cookie has been marked as secure?
body: <p>I am trying to mark the ASP session ID cookie as HttpOnly but can't seem to find a way to tell if it is working. The environment I am trying this in is as follows:
  OS: Windows Server 2003
  IIS: 6
  ASP Version: ASP 3 (Classic ASP)</p>
  
  <p>In order to mark the cookie as http only, I followed <a href="http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/0d49cbc8-10e1-4fa8-ba61-c34e524a3ae6.mspx?mfr=true" rel="nofollow noreferrer">MS KB</a></p>
  
  <p>As per our architect's suggestion, to test whether this works, a javascript document.cookie should not be able to read the ASPSESSIONID* cookie. My issue is that javascript:alert(document.cookie) still echoes the ASPSESSIONID* cookie, albeit it appears to be encrypted(?) </p>
  
  <p>I also tried to do this via Response.AddHeader "Set-Cookie" but can't determine what value to give for this header to mark all the cookies OR AT LEAST the ASP Session ID cookie as HttpOnly. 
  Help!!!</p>