Observability

SolarWinds web console issues after enabling IIS CIS rule 3.7 “cookies set with HttpOnly attribute”

This article helps when customer faces issues after enabling 3.7 “Ensure ‘cookies’ are set with HttpOnly attribute – Applications.

First published date

6/15/2026 3:29 PM

Last published date

6/15/2026 3:29 PM

Overview

After implementing IIS hardening according to CIS benchmark rule 3.7 “Ensure ‘cookies’ are set with HttpOnly attribute – Applications” by setting httpOnlyCookies="true" in IIS or in the web.config, the SolarWinds Platform Web Console stops working correctly. Users see menu and navigation failures, missing resources, and errors when loading the SolarWinds Platform Web Console.

This article explains why this happens and how to safely revert the change for the SolarWinds site while still maintaining a hardened configuration.

Product section

Hybrid Cloud Observability

Cause

SolarWinds uses several cookies that must remain readable by client-side JavaScript as part of its cross-site request forgery (CSRF) protection and UI logic. Examples include:

  • XSRF-TOKEN
  • Orion_IsSessionExp
  • TestCookieSupport

When the IIS setting httpOnlyCookies="true" is enforced globally (for the server or site), IIS adds the HttpOnly flag to all cookies. This prevents JavaScript from reading these CSRF-related cookies. As a result, all AJAX/API requests fail validation and multiple SolarWinds Platform web components stop functioning, causing menu failures, missing trees/maps, and related errors.

SolarWinds already applies HttpOnly to security-sensitive cookies. The cookies flagged by vulnerability scanners and CIS 3.7 in this scenario either:

  • do not contain sensitive data, or
  • are intentionally readable by JavaScript to implement the OWASP double-submit cookie pattern for CSRF protection.

This behavior is by design and is not treated as a product vulnerability.

Resolution

 

  1. Revert the global HttpOnly enforcement for the SolarWinds site
    If httpOnlyCookies was changed through IIS Configuration Editor:
    1. Open IIS Manager on the SolarWinds server.
    2. In the Connections pane, expand Sites and select the SolarWinds NetPerfMon website.
    3. In the middle pane, open Configuration Editor.
    4. From the Section dropdown, select:
      system.web/httpCookies.
    5. Set the httpOnlyCookies property to False.
    6. Click Apply in the Actions pane to save the change.
  2. If the setting was applied directly in web.config
    If you previously hardened IIS by editing the application’s web.config, make sure the <httpCookies> element for the SolarWinds site does not force HttpOnly globally. For example, either remove the global override, or ensure it is set like this: <httpCookies httpOnlyCookies="false" requireSSL="false" />
  3. Restart IIS
    After reverting the setting, restart IIS so the change is picked up:
    • Open an elevated Command Prompt on the SolarWinds server.
    • Run: iisreset
  4. Validate the web console
    After IIS restarts, verify that the SolarWinds web console loads and functions normally:
    • Summary Home page loads without errors
    • Left navigation tree (nodes) appears
    • Menus load and respond correctly
    • Maps and other dynamic content render as expected
  5. Explain the deviation from CIS 3.7
    For audit or security teams, you can document the following points (adapt based on your internal policy):
    • CIS IIS rule 3.7 “Ensure ‘cookies’ are set with HttpOnly attribute – Applications” aims to protect session and sensitive cookies from client-side access.
    • In SolarWinds, the cookies that remain without HttpOnly do not contain credentials or sensitive data; they are used to enforce CSRF protection and support UI behavior.
    • Forcing httpOnlyCookies="true" globally breaks the SolarWinds web console because the CSRF-protection cookie can no longer be read by JavaScript, causing API/AJAX requests to fail.
    • SolarWinds already sets HttpOnly on security-sensitive cookies; the remaining non-HttpOnly cookies are intentionally readable and this configuration is considered expected and supported product behavior, not a vulnerability.
  6. Use supported alternative hardening measures
    Instead of enforcing global HttpOnly on all cookies, consider enabling and validating the following supported controls around the SolarWinds site:
    1. HSTS (HTTP Strict Transport Security)
      • Enable HSTS for the SolarWinds site so browsers always use HTTPS, reducing the risk of SSL stripping and some cookie-related attacks.
      • This can be configured either via IIS custom headers or via the Secure configuration options in the SolarWinds Platform.
    2. TLS configuration and cipher hardening
      • Follow SolarWinds and OS guidance to restrict weak protocols and ciphers and align with your organization’s TLS baseline.
    3. IIS hardening in smaller, tested increments
      • Apply other CIS IIS recommendations (request filtering, HTTP TRACE disable, IP restrictions, etc.) one at a time and test the SolarWinds web console after each change, rather than applying the full benchmark in bulk.
    4. Use SolarWinds platform secure configuration options
      • Review the SolarWinds secure configuration guidance for platform-level security settings (cookie secure flag, HTTPS enforcement, account lockout, etc.) and enable what is appropriate for your environment.