title: Forms authentication with requireSSL=true not returning cookie with Secure attribute
body: <p>I'm seeing a strange response from our IIS site now that we've upgraded the host from Win2K3/IIS6 to Win2k8R2/IIS7.5.  ASP.Net version 4.0</p>
  
  <p>We have a significantly complex and mature web application that uses Forms Authentication with the following config:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms loginUrl="~/Login" timeout="2000" domain="xx.xx.com" requireSSL="true" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>The Login URL directs to an ASP.Net MVC 3 page properly configured for SSL.</p>
  
  <p>The site behaved as expected in IIS6, but ever since the host migration, <strong><em>upon successful login the auth cookie in the response header is missing the Secure and HttpOnly attributes</em></strong>.  This is problematic as we have a mixed content site with many HTTP pages.  The auth cookie is now sent in every request, not just in requests over HTTPS and is now open to a session stealing vulnerability.</p>
  
  <p>Our Logoff link successfully sends a zero length cookie that does include the Secure and HttpOnly attributes.</p>
  
  <p>Here's the raw responses after successful login and logoff from Fiddler, edited to protect the innocent :)</p>
  
  <pre><code>Login Response:
  
  HTTP/1.1 200 OK
  Cache-Control: private
  Content-Type: application/json; charset=utf-8
  Set-Cookie: .ASPXAUTH=83FCCA...102D; domain=xx.xx.com; path=/
  Date: Fri, 25 Jan 2013 22:53:31 GMT
  Content-Length: 84
  
  {...}
  
  
  Logoff Response:
  
  HTTP/1.1 302 Found
  
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Location: http://xx.xx.com/?...
  Set-Cookie: .ASPXAUTH=; domain=xx.xx.com; expires=Tue, 12-Oct-1999 04:00:00 GMT; path=/; secure; HttpOnly
  Set-Cookie: logoff=; path=/
  Set-Cookie: ...
  Date: Fri, 25 Jan 2013 22:57:01 GMT
  Content-Length: 64053
  
  &lt;html&gt;&lt;head&gt;&lt;title&gt;...
  </code></pre>
  
  <p>Changing the Integrated Pipeline setting of the app pool has no effect.</p>
  
  <p>Here are the important parts of the cookie creation code:</p>
  
  <pre><code>    var ctx = HttpContextFactory.Current;
  
      var cookie = new HttpCookie(
          FormsAuthentication.FormsCookieName,
          FormsAuthentication.Encrypt(
              new FormsAuthenticationTicket(
                  SessionId,
                  false,
                  Convert.ToInt32(FormsAuthentication.Timeout.TotalMinutes)
              )
          )
      ) { Domain = domain };
  
      ctx.Response.Cookies.Add(cookie);
  </code></pre>
  
  <p>Any thoughts on where to start looking for what's causing this?  </p>