title: ASP Session Cookies Removal
body: <p>Using the following web.config file properties I am not able to have my site either remove a session cookie or force the cookie to use HTTPOnly. I am using a basic classic asp website with the below configuration in my web.config file</p>
  
  <pre><code>&lt;configuration&gt;
    &lt;system.web&gt;
    &lt;httpCookies httpOnlyCookies="true" /&gt;
    &lt;sessionState mode="Off" cookieless="true"/&gt;
    &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I have tried to use the following outbound rule to rewrite the URL however when the site gets scanned using Qualys it does not rewrite the cookie before the website is scanned. Here is the below property code that is not working: </p>
  
  <pre><code> &lt;outboundRules&gt;
      &lt;rule name="Add HttpOnly" preCondition="No HttpOnly"&gt;
          &lt;match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" /&gt;
          &lt;action type="Rewrite" value="{R:0}; HttpOnly" /&gt;
          &lt;conditions&gt;
          &lt;/conditions&gt;
      &lt;/rule&gt;
      &lt;preConditions&gt;
          &lt;preCondition name="No HttpOnly"&gt;
              &lt;add input="{RESPONSE_Set_Cookie}" pattern="." /&gt;
              &lt;add input="{RESPONSE_Set_Cookie}" pattern="; HttpOnly" negate="true" /&gt;
          &lt;/preCondition&gt;
      &lt;/preConditions&gt;
  &lt;/outboundRules&gt; 
  </code></pre>