Does ARRAffinity cookie need HttpOnly flag

Question

I wanted to understand the security threat caused by not setting httponly flag for ARRAffinity cookie which is sent by ARR. Do i need to set the httponly flag? If not why?

Answer 1

ARRAffinity cookie don't need HttpOnly flag. I found below feedback which is raised in 2016. And Azure team gave response in 2017.

Set ARRAffinity cookie with correct attributes - HTTPOnly & Secure

But now,ARRAffinity has set the httponly flag by default. We don't need to manually set httponly.

ARRAffinity and ARRAffinitySameSite are both used to tell Azure which iis instance should be reached.

Hope the following article can help you.

Securing the ARRAffinity Cookie

If we set like below code, in our browser, we can't get cookies which is security.

HttpCookie myCookie = new HttpCookie("AUTH_COOKIE"); 
myCookie.Values.Add("userid", Guid.NewGuid().ToString());
myCookie.HttpOnly = true;
myCookie.Expires = DateTime.Now.AddHours(12);
Response.Cookies.Add(myCookie);