Add this method to your Global.asax file to append the "secure" attribute to any Set-
cookie that is issued over https,
Code:
Protected Sub Application_EndRequest(ByVal sender As Object, ByVal e As System.EventArgs)
If Request.IsSecureConnection Then
For Each [b][/b][b][/b]cookie As String In Response.[b][/b][b][/b]cookies
Response.[b][/b][b][/b]cookies([b][/b][b][/b]cookie).Secure = True
Next
End If
End Sub
In my simple testing, two
cookies were set during checkout:
<OL>
<LI>The userid
cookie, but only if the customer signs in during checkout, and checks Remember Me.
* The cartid
cookie (to an empty string) after checkout is completed, presumably to "clear" the cart.
</OL>
In practice, this will prevent the browser from "remembering" who you are between sessions. If you login over a https, and check "Remember Me"; the userid
cookie will be sent to your browser with the "secure" attribute. If you close your browser, then
open it again and navigate to the home page over http, the userid
cookie will not be sent to the server, and the store will not "remember" you.
To avoid frustrating your customers, I recommend disabling the "Remember Users" option (BV Admin > Options > Site Settings > Users) if you have enabled SSL (BV Admin > Options > Security) and implement the code above.
Ironically, if you disable "Remember Users", then the only
cookies that are set during checkout are empty values to clear the userid and cartid
cookies. Hardly a "huge" security issue.