先在URL重新模块添加服务器变量：

添加变量名：Add HttpOnly

网站根目录web.config添加如下规则：

<?xml version="1.0" encoding="UTF-8"?>
<configuration><system.webServer><rewrite><outboundRules><rule name="Add HttpOnly" preCondition="No HttpOnly"><match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" /><action type="Rewrite" value="{R:0}; HttpOnly" /><conditions></conditions></rule><preConditions><preCondition name="No HttpOnly"><add input="{RESPONSE_Set_Cookie}" pattern="." /><add input="{RESPONSE_Set_Cookie}" pattern="; HttpOnly" negate="true" /></preCondition></preConditions></outboundRules>
</rewrite>
</system.webServer>
</configuration>

验证是否已完成修复（如果才访问过，需要先清除才会显示）：

备注：在虚拟主机中测试只在网站根目录中添加这个web.config文件效果也一样