How do I set secure flag on cookie in asp.net web api -

i need change httponly , secure flag on cookies being generated web.api.

to this, added global filter modifies every response web.api. have code in iis using presendrequestheaders event doesn't work when self hosting.

the cookies need change session , forms auth cookies. httponly flag isn't main problem, it's secure flag problem ssl offloading it's not set secure automatically.

i can use httpresponseheadersextensions add cookies, can't see update existing cookies.

i want avoid parsing set-cookie header manually. what's best way achieve this?

(this needs work in self host , in iis, httpcontext.current can't used)

say cookie set apicontroller itself. component controller it, so:

public httpresponsemessage get(int id) {     var cookie = new cookieheadervalue("abc", "12345");     cookie.path = "/";      var response = request.createresponse();     response.headers.addcookies(new cookieheadervalue[] { cookie });     return response; } 

again, cookie can cookie including formsauth. use normal cookie. if have message handler, can create httponly , secure cookie same key, so:

public class myhandler : delegatinghandler {     protected override async task<httpresponsemessage> sendasync(                                     httprequestmessage request,                                           cancellationtoken cancellationtoken)     {         var response = await base.sendasync(request, cancellationtoken);          var cookie = new cookieheadervalue("abc", "12345");         cookie.secure = true;         cookie.httponly = true;         cookie.path = "/";          response.headers.addcookies(new cookieheadervalue[] { cookie });          return response;     } } 

the cookie sent client secure httponly cookie.