title: Setting HttpOnly=true on ASP 1.1 Session ID cookie
body: <p>I have a client who runs his Classic ASP site under IIS 6.0. The web site is targeted for ASP.NET 2.0 in the ASP.NET configuration tab. A recent PCI Scan of his site is failing him with an HttpOnly vulnerability on his ASPSESSIONID cookie. </p>
  
  <p>I have installed an ISAPI .dll that successfully sets HttpOnly on all manually created cookies, but ASPSESSIONID cookie is not effected by this for some reason.</p>
  
  <p>I have set web.config with the following configuration:</p>
  
  <pre><code>&lt;system.web&gt;
      &lt;httpCookies httpOnlyCookies="true" /&gt;
  &lt;/system.web&gt;
  </code></pre>
  
  <p>This configuration seems to have no effect whatsoever, on anything. I suspect, even though the web site is targeted for ASP.NET 2.0 it is afterall a Classic ASP application and HttpOnly wasn't supported at all.</p>
  
  <p>The client's web site uses a <code>global.asa</code> instead of <code>global.asax</code>. This rules out using Application_EndRequest to add HttpOnly.</p>
  
  <p>I can load up the client's site using Firefox/Firebug and see the cookies. Those manually created are getting HttpOnly set, but the ASPSESSIONID cookie is not HttpOnly.</p>
  
  <p>Is anyone aware of how to cause the ASPSESSIONID cookie to be HttpOnly given this setup scenario?</p>