So I've been looking into implementing HttpOnly and SecureCookies in my web environment. I have an F5 as the load balancer and a couple of C# web applications hosted in iis 7.5 for the website. The .net applications are an old asp.net legacy application and a newer MVC4 application.
I stumbled across this interesting article on how to implement the change. http://geekflare.com/f5-irule-to-secure-cookie-with-httponly-and-secure/
My question is, does setting the flags at the load balancer defeat the purpose? Will .Net honor the flags even if it was the load balancer that put them on?