Search code examples
servicestacksession-cookies

secure session cookie in servicestack

Can anyone tell me how to get ServiceStack to use secure attribute on the session cookies so that the cookie is only sent on https based requests. This is important for helping to prevent session hijacking. My tests so far show that if ServiceStack authentication in done on a https website it still sets the cookies to no be secure meaning if there are any http requests in the site the cookies could be captured.

Is there a setting or config to change this?

Solution

  • You can use the Config.UseSecureCookies option to tell ServiceStack to add a Secure cookie for SessionIds in HTTPS requests:

    SetConfig(new HostConfig { 
  UseSecureCookies = true
});