title: Force all cookies setting to Secure in Classic ASP/VBScript
body: <p>I maintain an ancient website written mostly in Classic ASP/VBScript (<strong>not</strong> ASP.NET). When it was written, HTTPS wasn’t really a thing yet and everything on the site was horribly vulnerable when I took over, but I’ve since forced HTTPS wherever I can.</p>
  <p>In the most recent versions of Firefox, I’ve been getting oodles of console warnings about cookies when visiting the site:</p>
  <blockquote>
  <p>Cookie “XYZ” will be soon treated as cross-site cookie against “https://example.com/page.asp” because the scheme does not match.</p>
  </blockquote>
  <p>I’m assuming – though I haven’t been able to find any confirmation – that this is because the cookies set by the server are not set as secure, something I’d failed to consider when I moved the site to HTTPS.</p>
  <p>So now I need to change everything to set all cookies as secure. Trouble is, a quick search tells me there are about 850 cookies set in about 175 files on the server, and… well, I’m lazy and don’t feel much like going through 175 files and adding <code>Response.Cookies(&quot;XYZ&quot;).Secure = True</code> 850 times.</p>
  <p>Is there some way to make the server (IIS, I’m guessing?) automatically force all cookies to be set as secure?</p>
  <blockquote>
  <p><strong>Edit:</strong> A lot of the more recent stuff I’ve changed/built/added to the website is done in PHP, just to avoid Classic ASP. I’ve just noticed that this list of cookies that are said to “be soon treated as cross-site” only appears on PHP pages, not on actual ASP pages. So perhaps “the scheme does not match” isn’t just about HTTP vs HTTPS but also about ASP vs PHP somehow? How would I go about making sure that cookies set in ASP are not considered cross-site on PHP pages? I didn’t think the language that creates the cookies would make a difference since they’re all just plain text cookies made over an HTTPS connection…</p>
  </blockquote>