title: Using IIS Rewrite to add HttpOnly Flag To Cookies Not Working
body: <p>I found numerous examples of adding the HttpOnly to my cookies but it does not work for me and I am not sure why. All the examples I found were the same and I copied this one from one of the posts that I had found. I am using .NET 3.5 under IIS 7.0. Hopefully someone can tell me what I am doing wrong? Thanks</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;rewrite&gt;
    &lt;outboundRules&gt;
      &lt;rule name="Add HttpOnly" preCondition="No HttpOnly"&gt;
        &lt;match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" /&gt;
        &lt;action type="Rewrite" value="{R:0}; HttpOnly" /&gt;
        &lt;conditions&gt;
        &lt;/conditions&gt;
      &lt;/rule&gt;
      &lt;preConditions&gt;
        &lt;preCondition name="No HttpOnly"&gt;
          &lt;add input="{RESPONSE_Set_Cookie}" pattern="." /&gt;
          &lt;add input="{RESPONSE_Set_Cookie}" pattern="; HttpOnly" negate="true" /&gt;
        &lt;/preCondition&gt;
      &lt;/preConditions&gt;
    &lt;/outboundRules&gt;
  &lt;/rewrite&gt;
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I figured out how to turn on tracing and found that the preCondition is looking at all the cookies as a whole instead of each individual cookie. </p>
  
  <p>So instead of evaluating</p>
  
  <pre><code>Set-Cookie: myC5=we have S Cookie; path=/; secure
  Set-Cookie: myC6=we have S Cookie; path=/; secure
  Set-Cookie: myC7=we have S Cookie; path=/; secure; HttpOnly
  </code></pre>
  
  <p>It is evaluating</p>
  
  <pre><code>myC5=we have S Cookie; path=/; secure,myC6=we have S Cookie; path=/; secure,myC7=we have S Cookie; path=/; secure; HttpOnly
  </code></pre>
  
  <p>Since the whole string has ; HttpOnly in it, the preCondition fails.</p>
  
  <p>How do I get past this? Any ideas?</p>