Fix \Magento\Checkout\Controller\Index\Index::isSecureRequest method to take care of current request being secure and also from referer, as stated in phpdoc block

Author: adrian-martinez-interactiv4

app/code/Magento/Checkout/Controller/Index/Index.php

@@ -51,18 +51,16 @@ public function execute()
      */
     private function isSecureRequest(): bool
     {
-        $secure = false;
         $request = $this->getRequest();
 
-        if ($request->isSecure()) {
-            $secure = true;
-        }
+        $referrer = $request->getHeader('referer');
+        $secure = false;
 
-        if ($request->getHeader('referer')) {
-            $scheme = parse_url($request->getHeader('referer'), PHP_URL_SCHEME);
+        if ($referrer) {
+            $scheme = parse_url($referrer, PHP_URL_SCHEME);
             $secure = $scheme === 'https';
         }
 
-        return $secure;
+        return $secure && $request->isSecure();
     }
 }

app/code/Magento/Checkout/Test/Unit/Controller/Index/IndexTest.php

@@ -236,26 +236,27 @@ public function testRegenerateSessionIdOnExecute(bool $secure, string $referer,
     public function sessionRegenerationDataProvider(): array
     {
         return [
+            [
+                'secure' => false,
+                'referer' => 'https://test.domain.com/',
+                'expectedCall' => self::once()
+            ],
             [
                 'secure' => true,
                 'referer' => false,
-                'expectedCall' => self::never()
+                'expectedCall' => self::once()
             ],
             [
                 'secure' => true,
-                'referer' => 'https://test.domain.com/',
-                'expectedCall' => self::never()
+                'referer' => 'http://test.domain.com/',
+                'expectedCall' => self::once()
             ],
+            // This is the only case in which session regeneration can be skipped
             [
-                'secure' => false,
+                'secure' => true,
                 'referer' => 'https://test.domain.com/',
                 'expectedCall' => self::never()
             ],
-            [
-                'secure' => true,
-                'referer' => 'http://test.domain.com/',
-                'expectedCall' => self::once()
-            ]
         ];
     }