How to Set Cookie Without Secure flag in IIS SERVER

o ensure that cookies are set with the Secure flag in an IIS server, you need to configure your site to use this flag. The Secure flag ensures that cookies are only sent over HTTPS, improving the security of your web application by preventing them from being sent over unencrypted connections.

Here’s how you can configure the Secure flag for cookies in IIS:

1. Enable HTTPS (SSL) on IIS

The Secure flag will only work if your website is served over HTTPS. Make sure that your site is configured to use SSL/TLS.

Steps to Enable HTTPS:

1. Obtain an SSL Certificate: You need an SSL certificate from a trusted Certificate Authority (CA), or you can create a self-signed certificate for testing.
2. Bind the SSL Certificate:
   • Open IIS Manager.
   • Expand the server node and select Sites.
   • Choose the site where you want to enable HTTPS.
   • In the Actions pane, click on Bindings.
   • Add a new HTTPS binding and select your SSL certificate.
3. Require SSL (optional but recommended):
   • Select your site in IIS Manager.
   • Double-click SSL Settings.
   • Check Require SSL and click Apply.

2. Set the Secure Flag for Cookies in web.config

You can explicitly add the Secure flag for cookies in IIS by modifying the web.config file for your application.

Steps to Set Secure Flag:

1. Open the web.config file:
   • Navigate to the root directory of your website or application (e.g., C:\inetpub\wwwroot\your-site).
   • Open the web.config file in a text editor.
2. Add the following configuration under the <system.webServer> section to apply the Secure flag to cookies:

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Set-Cookie" value="Secure" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

This will ensure that all cookies are appended with the Secure flag, making them HTTPS-only.

Save the changes and restart IIS using the following command:

iisreset

Using URL Rewrite to Force the Secure Flag

If you are using URL Rewrite in IIS, you can use an outbound rule to modify cookies and add the Secure flag to them. This provides additional flexibility and works at the HTTP response level.

Steps:

1. Open IIS Manager and navigate to your website.
2. Double-click on URL Rewrite.
3. Click on Add Rules and choose Outbound Rules.
4. Add a new outbound rule to modify the cookie headers:
   • Set the Match condition to target the Set-Cookie header.
   • Use Rewrite as the action type.
   • In the Action Properties section, set the rule to append the Secure flag to the cookie header:

{R:0}; Secure

1. Apply the rule and restart IIS.

4. Secure Cookies in Laravel (for Laravel Apps on IIS)

If your application is a Laravel application, it manages the session cookies through the configuration file. Here’s how to configure the Secure flag in Laravel:

1. Open the config/session.php file in your Laravel project.

'secure' => env('SESSION_SECURE_COOKIE', false),

Set it to true to ensure that session cookies are only sent over HTTPS:

'secure' => env('SESSION_SECURE_COOKIE', true),

Update your .env file to enable the secure flag for cookies:

SESSION_SECURE_COOKIE=true

Clear the config cache in Laravel:

php artisan config:cache

Enforce HTTPS Using Redirect Rules

To make sure users always access your site over HTTPS, you can add a rule in IIS to redirect all HTTP traffic to HTTPS.

Steps:

1. Open IIS Manager.
2. Navigate to your site and double-click URL Rewrite.
3. Add a new Inbound Rule to redirect HTTP requests to HTTPS:
   • Set the Match URL to .* (to match all requests).
   • Under Conditions, add a condition that checks whether the request is not HTTPS:
     • Condition input: {HTTPS}
     • Check if input string: Matches the pattern
     • Pattern: ^OFF$
   • In the Action section, select Redirect, and enter https://{HTTP_HOST}/{R:1} as the redirect URL.
4. Apply the rule and restart IIS.

6. Test Cookie Settings

After making the changes, it’s important to verify that the Secure flag is applied to cookies.

Testing with Browser Developer Tools:

1. Open the Developer Tools in your browser (e.g., Chrome, press F12).
2. Go to the Application tab.
3. Look under the Cookies section to check the cookies set by your application.
4. Verify that the Secure flag is applied.

Testing with Curl:

You can also use curl to test the Set-Cookie header:

curl -I https://your-domain.com

The response should include cookies with the Secure flag set.