Secure Flag for ASPXAUTH Cookie

I found this piece of code to which made my authentication cookie secure. I cant remember the source of this but if you add it to your global.asax, it sorts the issue. I do not know why but requireSSL=true in your tag was not enough to make it secure.

  protected void Application_EndRequest(Object sender, EventArgs e)
    {
        string authCookie = FormsAuthentication.FormsCookieName;

        foreach (string sCookie in Request.Cookies)
        {
            if (sCookie.Equals(authCookie))
            {
                // Set the cookie to be secure. Browsers will send the cookie
                // only to pages requested with https
                var httpCookie = Response.Cookies[sCookie];
                if (httpCookie != null) httpCookie.Secure = true;
            }
        }
    }

Your issue looks to be that because your form is incorrectly configured. You have:

<forms ... requireSSL="" ... />

and you should have

<forms ... requireSSL="true" ... />

According to Microsoft the requireSSL attribute in the httpCookies tag is overridden by the requireSSL attribute of the forms tag. You didn't set the value, but you specified it may cause IIS to use the default of false. You should set it to true.