title: Securing cookies in ASP.NET
body: <p>i know this question has been asked many times but i dont know why i m unable to sort out this issue </p>
  
  <pre><code>&lt;system.web&gt;
   &lt;httpCookies httpOnlyCookies="true" requireSSL="false" domain=""/&gt;
   &lt;sessionState mode="InProc" customProvider="DefaultSessionProvider" timeout="20" cookieName="id"&gt;
  &lt;/system.web&gt;
  </code></pre>
  
  <p>but its not working as required</p>
  
  <p>can someone help me how to get it fixed or what i m doing wrong .</p>
  
  <p>i have tried to get it fixed in code in Global.asax on App</p>
  
  <pre><code>protected void Application_EndRequest()
          {
             foreach (string s in Response.Cookies.AllKeys)
              {
                  if (s.ToLower() == "id")
                  {
                      Response.Cookies[s].HttpOnly = true;                      
                  }
              }
          }
  </code></pre>
  
  <p>Enviroment: <strong>ASP.NET MVC</strong></p>
  
  <p>Regards</p>