From 6552ec99b76af9766232bc185d12083cfd5cf92b Mon Sep 17 00:00:00 2001
From: "SARWAR, Muhammed" <Muhammed.SARWAR@EDUCATION.GOV.UK>
Date: Thu, 30 Jul 2026 12:18:30 +0100
Subject: [PATCH] Cookie Without Secure Flag Set for pen test

---
 .../SFA.DAS.ProviderCommitments.Web/Startup.cs           | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/SFA.DAS.ProviderCommitments/SFA.DAS.ProviderCommitments.Web/Startup.cs b/src/SFA.DAS.ProviderCommitments/SFA.DAS.ProviderCommitments.Web/Startup.cs
index fdc84d198..dea753004 100644
--- a/src/SFA.DAS.ProviderCommitments/SFA.DAS.ProviderCommitments.Web/Startup.cs
+++ b/src/SFA.DAS.ProviderCommitments/SFA.DAS.ProviderCommitments.Web/Startup.cs
@@ -1,5 +1,6 @@
 using AspNetCore.IServiceCollection.AddIUrlHelper;
 using FluentValidation;
+using Microsoft.AspNetCore.CookiePolicy;
 using OpenTelemetry.Logs;
 using SFA.DAS.Provider.Shared.UI.Startup;
 using SFA.DAS.ProviderCommitments.Application.Commands.CreateCohort;
@@ -46,6 +47,8 @@ public void ConfigureServices(IServiceCollection services)
             // This lambda determines whether user consent for non-essential cookies is needed for a given request.
             options.CheckConsentNeeded = _ => true;
             options.MinimumSameSitePolicy = SameSiteMode.None;
+            options.Secure = CookieSecurePolicy.Always;
+            options.HttpOnly = HttpOnlyPolicy.Always;
         });
 
         services.AddConfigurationOptions(_configuration);
@@ -88,6 +91,12 @@ public void ConfigureServices(IServiceCollection services)
             options.Cookie.IsEssential = true;
             options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
         });
+        services.AddAntiforgery(options =>
+        {
+            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+            options.Cookie.HttpOnly = true;
+            options.Cookie.IsEssential = true;
+        });
 
         services.AddHttpClient();
         services.AddOpenTelemetryRegistration(_configuration);