This is a duplicate post. It first marked as spam and I posted a new one later since it took too long for this post to come out of spam list!
The question has been answered here
Set-Cookie on successful client response from External Authorization (headers to downstream on allow) - Security - Discuss Istio