Session value is not retained when httpCookies requireSSL="true"

Dear All,

We have a website(web-forms) developed with Asp.Net 4.0 . It can be accessed with two domain names one with HTTPS and other with HTTP (non-ssl)

Recently for our website, we did the dynamic security scan, it given the result few security issues and to fix those issues we have added the below settings in the web config file.

"true" />
"X-Frame-Options" value="SAMEORIGIN" />
"Strict-Transport-Security" value="max-age=31536000; includeSubDomains"/>
"X-XSS-Protection" value="1; mode=block" />
"X-Content-Type-Options" value="nosniff" />
"Content-Security-Policy" value="default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self'" />

Due to these changes, we are facing an issue with the domain name that doesn't have SSL, the issue is that the website doesn't retain the SESSION values. However, the domain name with SSL is working fine.

My observation is,

The website doesn't reported any issue when we checked in the local host server(Without SSL) but only in the production it exhibits such issue with the domain that doesn't have SSL.

Please help me to solve this issue.

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Sachin Singh5y ago
at first explain me the reason for keeping two urls one with http and one with https. why don't you divert all the http routes to https.
first , with two urls your traffice will be divided into two parts, as google sees each url as a seperate website, google may penalize your site for this, as fro SEO it is very bad.
second , when you already have SSL certificate then what's the point of keeping http? simply use 301 parmanent redirect .
if you have any specific point for 2 urls then let me know, then i will come to your original question about session.