How to Setting the Secure and HTTPOnly flags on the JSESSIONID cookie in IIS?

Question

Hi,
I am trying to enable Secure flag on the JSESSIONID cookie.

Please advise on how proceed.

Thanks,
Tee

Answer 1

Hi @TheOne xD ,

HttpOnly Flag

The first flag we need to set up is HttpOnly flag. By default, when there’s no restriction in place, cookies can be transferred not only by HTTP, but any JavaScript files loaded on a page can also access the cookies. This ability can be dangerous because it makes the page vulnerable to cross-site scripting (XSS) attack. The only way to restrict this is by setting HttpOnly flag, which means the only way cookies are sent is via HTTP connection, not directly through other means (i.e., JavaScript).

Enable HttpOnly Flag in IIS

Edit the web.config file of your web application and add the following:

<system.web>  
  ...  
  <httpCookies httpOnlyCookies="true" requireSSL="true" />  
  ...  
</system.web>  

Secure Flag

The second flag we need to pay attention to is Secure flag. This flag highlights the second issue that by default cookies are always sent on both HTTP and HTTPS requests. A malicious attacker who can’t see encrypted traffic with HTTPS connection can easily switch to HTTP connection and access the same cookie because it is not encrypted. Therefore, we need to set the Secure flag to ensure that the cookie in encrypted when it’s created.

Enable Secure Flag in IIS

To enable secure flag in IIS, it is better to use URL Rewrite and add the following to your web.config file:

<system.webServer>  
  <rewrite>  
    <outboundRules>  
      <rule name="Use only secure cookies" preCondition="Unsecured cookie">  
        <match serverVariable="RESPONSE_SET_COOKIE" pattern=".*" negate="false" />  
        <action type="Rewrite" value="{R:0}; secure" />  
      </rule>  
      <preConditions>  
        <preCondition name="Unsecured cookie">  
          <add input="{RESPONSE_SET_COOKIE}" pattern="." />  
          <add input="{RESPONSE_SET_COOKIE}" pattern="; secure" negate="true" />  
        </preCondition>  
      </preConditions>  
    </outboundRules>  
  </rewrite>  
...  
</system.webServer>  

Supplementary content:

However, if you have a <forms> element in your system.web\authentication block, then this will override the setting in httpCookies, setting it back to the default false.

In that case, you need to add the requireSSL="true" attribute to the forms element as well.

So you will end up with:

<system.web>  
    <authentication mode="Forms">  
        <forms requireSSL="true">  
            <!-- forms content -->  
        </forms>  
    </authentication>  
</system.web>  

See here and here for MSDN documentation of these elements.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the email notification for this thread.

Best regards,
Yurong Dai

Answer 2

Hi @Yurong Dai-MSFT
Thank you so much for reply.

I have added

But the JSESSIONID is still not yet SECURE.