You may be redirected to the forms authentication logon page, or you may receive an error message when you try to run an application that is built by using the .NET Framework 2.0 (917412)

RESOLUTION

To resolve this problem, set the HttpOnly attribute for the session cookie to the false value.

Note Setting the HttpOnly attribute to the true value does not prevent a malicious user from accessing the cookie directly when the malicious user has access to the network channel. Consider using Secure Sockets Layer (SSL) to help protect against this. Workstation security is also important. A malicious user may use an open browser window or a computer that contains persistent cookies to access a Web site by using a legitimate user's identity.

To set the HttpOnly attribute to the false value, replace the Session_Start method in the Global.asax file by using the following code.

   void Session_Start(object sender, EventArgs e)
        {
            if (Response.Cookies.Count > 0)
            {
                foreach (string s in Response.Cookies.AllKeys)
                {
                    if (s == System.Web.Security.FormsAuthentication.FormsCookieName || s.ToLower() == "asp.net_sessionid")
                    {
                        Response.Cookies[s].HttpOnly = false;
                    }
                }
            }
        }

Note If you want to reuse this code in multiple applications, put this code in a custom HttpModule class.