From 0fb683bbacebb9102054ca64abe82e6558e2e392 Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Wed, 29 Jun 2022 19:33:40 +0300
Subject: [PATCH] secure cookie

---
 .../Core/Authentication/Authentication.php    | 31 +++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/application/Espo/Core/Authentication/Authentication.php b/application/Espo/Core/Authentication/Authentication.php
index 4154864609..89704b58d8 100644
--- a/application/Espo/Core/Authentication/Authentication.php
+++ b/application/Espo/Core/Authentication/Authentication.php
@@ -504,7 +504,7 @@ class Authentication
         );
 
         if ($createSecret) {
-            $this->setSecretInCookie($authToken->getSecret(), $response);
+            $this->setSecretInCookie($authToken->getSecret(), $response, $request);
         }
 
         if (
@@ -612,7 +612,7 @@ class Authentication
         $this->entityManager->saveEntity($authLogRecord);
     }
 
-    private function setSecretInCookie(?string $secret, Response $response): void
+    private function setSecretInCookie(?string $secret, Response $response, ?Request $request = null): void
     {
         $time = $secret ? strtotime('+1000 days') : 1;
 
@@ -625,9 +625,36 @@ class Authentication
             '; HttpOnly' .
             '; SameSite=Lax';
 
+        if ($request && self::isSecureRequest($request)) {
+            $headerValue .= "; Secure";
+        }
+
         $response->addHeader('Set-Cookie', $headerValue);
     }
 
+    private static function isSecureRequest(Request $request): bool
+    {
+        $https = $request->getServerParam('HTTPS');
+
+        if ($https === 'on') {
+            return true;
+        }
+
+        $scheme = $request->getServerParam('REQUEST_SCHEME');
+
+        if ($scheme === 'https') {
+            return true;
+        }
+
+        $forwardedProto = $request->getServerParam('HTTP_X_FORWARDED_PROTO');
+
+        if ($forwardedProto === 'https') {
+            return true;
+        }
+
+        return false;
+    }
+
     private function processFail(Result $result, AuthenticationData $data, Request $request): Result
     {
         $this->hookManager->processOnFail($result, $data, $request);