Removing "Set-Cookie" response header

[gauravjain_59]

I'm trying to remove the "Set-Cookie" : header from the response.

I tried removing it using an Assign Message Policy in the Proxy Endpoints' PreFlow but it didn't do it.

Then tried the same in PostFlow and then in TargetEndPoints' pre/post flow - still didn't work.

Also see the screenshot where I want the policy to be executed

removeheaderfromresponse.png

Here's the policy I have in place:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-RemoveResponseSetCookieHeader">
    <DisplayName>AM-RemoveResponseSetCookieHeader</DisplayName>
    <AssignTo createNew="false" transport="http" type="response"/>
    <Properties/>
    <Remove>
        <Headers>
            <Header name="Set-Cookie"/>
        </Headers>
    </Remove>
    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
</AssignMessage>

[omidt · Accepted solution]

Hi @GAURAV. A few suggestions...

1. Please could you ensure this AM policy is attached as a step inside the <Response> element of your Proxy Endpoint. The screenshot you've shared unfortunately does not show the attachment. FWIW, you're fine attaching this particular policy to either the Proxy or Target endpoint; it just has to be in the response flow.
2. In the interests of troubleshooting only, please try removing this header using a JS policy. I'm not suggesting this as your permanent fix. The snippet below should do the trick.
3. Please note that, according to the defined standards specification of Cookies (RFC 6265), a server may respond with multiple Set-Cookie headers. In this case, please see this page of the documentation for a note regarding multiple headers and how they can be handled.

// remove Set-Cookie header from response
context.removeVariable('response.header.Set-Cookie');

// in the case of multiple Set-Cookie headers, specify which instance
context.removeVariable('response.header.Set-Cookie.1');
context.removeVariable('response.header.Set-Cookie.2'); // etc.

Based on the information you've provided so far, everything else appears to be fine.