diff --git a/usersync/cookie.go b/usersync/cookie.go index 6ced4b620fb..13aa7f38dd3 100644 --- a/usersync/cookie.go +++ b/usersync/cookie.go @@ -193,19 +193,24 @@ func (cookie *PBSCookie) SetCookieOnResponse(w http.ResponseWriter, setSiteCooki currSize = len([]byte(httpCookie.String())) } - uidsCookieStr := httpCookie.String() + var uidsCookieStr string var sameSiteCookie *http.Cookie if setSiteCookie { + httpCookie.Secure = true + uidsCookieStr = httpCookie.String() uidsCookieStr += SameSiteAttribute sameSiteCookie = &http.Cookie{ Name: SameSiteCookieName, Value: SameSiteCookieValue, Expires: time.Now().Add(ttl), Path: "/", + Secure: true, } sameSiteCookieStr := sameSiteCookie.String() sameSiteCookieStr += SameSiteAttribute w.Header().Add("Set-Cookie", sameSiteCookieStr) + } else { + uidsCookieStr = httpCookie.String() } w.Header().Add("Set-Cookie", uidsCookieStr) } diff --git a/usersync/cookie_test.go b/usersync/cookie_test.go index a59f7def8ea..ef2e9911e46 100644 --- a/usersync/cookie_test.go +++ b/usersync/cookie_test.go @@ -425,6 +425,9 @@ func TestSetCookieOnResponseForSameSiteNone(t *testing.T) { if !strings.Contains(writtenCookie, "SSCookie=1") { t.Error("Set-Cookie should contain SSCookie=1") } + if !strings.Contains(writtenCookie, "; Secure;") { + t.Error("Set-Cookie should contain Secure") + } } func TestSetCookieOnResponseForOlderChromeVersion(t *testing.T) {