SecureSessionCookieModule Class

This exists for cookies the platform never creates itself — chiefly the ASP.NET session cookie, which the session module writes directly and which therefore never passes through CookieHelper. Cookies written through CookieHelper already decide their own Secure setting and are left exactly as they were.

Secure is only ever added, never removed. A cookie that already carries the flag is skipped, so nothing here can override a deliberate choice made elsewhere.

Register the module in every application that needs it — the administration site, each website and the API are separate applications with separate configuration:

<system.webServer>
  <modules>
    <add name="SecureSessionCookieModule"
         type="AdvantageCMS.Core.HttpModules.SecureSessionCookieModule, AdvantageCMS.Core" />
  </modules>
</system.webServer>

Where a site is served exclusively over HTTPS, the built-in <httpCookies requireSSL="true" /> setting achieves the same result with no code. This module earns its place when a site answers on both schemes, or sits behind a load balancer that terminates TLS, because the decision is then made per request rather than once in configuration.

Disable at runtime by setting the SecureCookiesEnabled appsetting to "false". Individual cookies can be left alone by naming them in SecureCookiesExcluded. Both settings are read once, when the type is first used.