Security Issue httpOnlyCookies="true" is not working with production environment

Question

Dear All, 
I have tired to make set cookie value as httpOnly
The development environment is working fine and give me an output like that 
Set-Cookie
WSS_KeepSessionAuthenticated={3644d93c-d1d3-46cd-845f-42c01640ab21};
path=/;
HttpOnly
But when implement the same changes in web.config production environment its not working 
Set-Cookie                NLSessionCdomainweb=a98q9jnsy0vXk5+RHeHnlKmM+HnneA9KmhIAR6g1bJiwTs8sD6d7dfV1gBffc8HiJXBowxdO8LhZAiIEKiFY6PzNWySyRs5rvgCfPu8XIFnqKcN4XQ4UL9PN3JI3f4E6;path=/;domain=.domain.com
I am using sharepoint 2010, under web.config i made the following changes  
Add following tags under system.web
<httpRuntime maxRequestLength="2097151" enableVersionHeader="false"
/>
<httpCookies httpOnlyCookies="true"/>
Add following tags under <system.webServer>
  <httpProtocol>
      <customHeaders>
               <remove name="X-Powered-By" />
             <remove name="MicrosoftSharePointTeamServices" />
      </customHeaders>
    </httpProtocol>
Can any one tell me why it's happening i have checked all possible reasons from my side but no success  
Regards 
Rashid Bilgrami 
RB

Answer 1

Hi,
From your description, I know you want to set cookie value as httpOnly but it is not work.
Please try to add codes below to your global.asax file:
<SCRIPT language="C#" runat="server">
protected void Session_Start(Object sender, EventArgs e)
 try
  if (Request.IsSecureConnection == true)
                Response.Cookies ["ASP.NET_SessionId"].Secure = true;
 catch (Exception)
</SCRIPT>
Please refer to this article:
https://social.technet.microsoft.com/Forums/sharepoint/en-US/0fe55c13-3911-422e-af17-cb5c1ab2abd7/missing-secure-httponly-flags-on-sharepoint-2010-cookie?forum=sharepointadminprevious.
Best Regards
Vincent Han
TechNet Community Support