IIS multiple response headers with the same name

I am using IIS Application Request Routing (ARR) with ModSecurity. ModSecurity is installed and configured with the OWASP Core rule set on Windows 2022. I am trying to improve the rule set by incorporating session based logic.

I am using this rule to extract the session cookie:

SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "(?i:(wordpresspass_.*?|j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid)=([^\s]+)\;\s?)" \
	"chain,phase:5,id:'981062',t:none,pass,nolog,capture, \
	setsid:%{TX.6}, \
	setvar:session.sessionid=%{TX.6}, \
	setvar:session.valid=1, \
	expirevar:session.valid=3600, \
	setvar:session.country_name=%{geo.country_name}"
	SecRule UNIQUE_ID "(.*)" "chain,t:none,t:sha1,t:hexEncode,capture, \
		setvar:session.csrf_token=%{TX.1}"
		SecRule REMOTE_ADDR "^(\d{1,3}\.\d{1,3}\.\d{1,3}\.)" "chain,capture,setvar:session.ip_block=%{tx.1}"
			SecRule REQUEST_HEADERS:User-Agent ".*" "t:none,t:sha1,t:hexEncode,setvar:session.ua=%{matched_var}"

The problem is, only the last Set-Cookie set by the application is found. I wrote a rule to help me determine how many Set-Cookie headers ModSecurity thinks I have by :

SecRule &RESPONSE_HEADERS:/Set-Cookie/ "@gt 1" "chain,phase:5,id:'981062',t:none,pass,nolog" 
	SecRule RESPONSE_HEADERS:/Set-Cookie2?/ "((?s).*)" \
		"t:none,nolog,capture, \
		setsid:%{TX.1}, \
		setvar:session.sessionid=%{TX.1}, \
		setvar:session.valid=1"

When greater than 1 (“@gt 1”) is set, the session file never gets created, but if it “@gt 0” the last Set-Cookie header is saved.

This https://coreruleset.org/20230717/cve-2023-38199-multiple-content-type-headers/
States:

“This issue was initially reported to the CRS project on 24 March 2023 via the ModSecurity project. We quickly established that the CRS reference platform was not affected (ModSecurity 2.9.x on Apache 2.4). This is because the Apache web server merges identically titled header fields into one, separating any different values with commas (as described in the HTTP standard). The problem is that the situation is different on other platforms. While Apache (our reference platform) merges Content-Type headers together allowing this behavior to be detected, Nginx, for example, will retain each separate, identically named header: no merging occurs.”

This states: https://learn.microsoft.com/en-us/answers/questions/555576/setting-multiple-response-headers-with-same-name-d “IIS doesn't allow custom response headers with the same name.”

Chrome at the end user, does show all 4 Set-Cookie headers in Developer Tools.

What IIS, ARR and/or ModSecurity configuration setting will allow ModSecurity to see all Set-Cookie headers?

Start by reproducing the response-header behavior with IIS, ARR, and ModSecurity using multiple Set-Cookie headers, then inspect how RESPONSE_HEADERS and its count operator expose them. Done means determining whether a configuration allows all headers to be seen, or documenting the platform limitation if it does not.