We had an internal audit and basically the only required attribute for the cookie is the "name" field. Common optional attributes are: "comment", "domain", "path", etc. The "secure" attribute must be set accordingly in order to prevent to cookie from being sent unencrypted. RFC 2965 states: "The Secure attribute (with no value) directs the user agent to use only (unspecified) secure means to contact the origin server whenever it sends back this cookie, to protect the confidentially and authenticity of the information in the cookie." For further reference please see the HTTP State Management Mechanism RFC 2965 at: http://www.ietf.org/rfc/rfc2965.txt and for "Best current practice" for use of HTTP State Management please see http://tools.ietf.org/html/rfc2964
Could you please support on this?
