How exactly do you configure httpOnly Cookies in ASP Classic?

Question

I\'m looking to implement httpOnly in my legacy ASP classic sites. Anyone knows how to do it?

Answer 1

If you are using IIS7 or IIS7.5 and install the URL Rewriting add-in then you can do this. You can create a rewriting rule that adds "HttpOnly" to any out going "Set-Cookie" headers. Paste the following into the section of your web.config. I then used Fiddler to prove the output.

Regards, Jeremy