private void secureCookie ( Cookie cookie , HttpServletRequest request ) { // if we can mark the cookie HTTP only, do so to protect this cookie even in case of XSS vulnerability. if ( SET_HTTP_ONLY != null ) { try { SET_HTTP_ONLY . invoke ( cookie , true ) ; } catch ( IllegalAccessException | InvocationTargetException e ) { // ignore } } // if the user is running Jenkins over HTTPS, we also want to prevent the cookie from leaking in HTTP. // whether the login is done over HTTPS or not would be a good enough approximation of whether Jenkins runs in // HTTPS or not, so use that. cookie . setSecure ( request . isSecure ( ) ) ; }
Force always the http - only flag and depending on the request put also the secure flag .