Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>If you run your Classic ASP web pages on IIS 7/7.5, then you can use the IIS URL Rewrite module to write a rule to make your cookies HTTPOnly.</p> <p>Paste the following into the section of your web.config:</p> <pre><code>&lt;rewrite&gt; &lt;outboundRules&gt; &lt;rule name="Add HttpOnly" preCondition="No HttpOnly"&gt; &lt;match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" /&gt; &lt;action type="Rewrite" value="{R:0}; HttpOnly" /&gt; &lt;conditions&gt; &lt;/conditions&gt; &lt;/rule&gt; &lt;preConditions&gt; &lt;preCondition name="No HttpOnly"&gt; &lt;add input="{RESPONSE_Set_Cookie}" pattern="." /&gt; &lt;add input="{RESPONSE_Set_Cookie}" pattern="; HttpOnly" negate="true" /&gt; &lt;/preCondition&gt; &lt;/preConditions&gt; &lt;/outboundRules&gt; &lt;/rewrite&gt; </code></pre> <p>See here for the details: <a href="http://forums.iis.net/t/1168473.aspx/1/10">http://forums.iis.net/t/1168473.aspx/1/10</a> </p> <p>For background, HTTPOnly cookies are required for PCI compliance reasons. The PCI standards folks (for credit card security) make you have HTTPOnly on your sessionID cookies at the very least in order to help prevent XSS attacks. </p> <p>Also, at the current time (2-11-2013), all major browser support the HTTPOnly restriction on cookies. This includes current versions of IE, Firefox, Chrome and Safari. </p> <p>See here for more info on how this works and support by various browser versions: <a href="https://www.owasp.org/index.php/HTTPOnly">https://www.owasp.org/index.php/HTTPOnly</a> </p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload