MAGETWO-45159: [ZAP-M2]: Cookie set without secure flag

Author: Dale Sikkema

app/code/Magento/Backend/Model/Session/AdminConfig.php

@@ -84,6 +84,7 @@ public function __construct(
         $adminPath = $this->extractAdminPath();
         $this->setCookiePath($adminPath);
         $this->setName($sessionName);
+        $this->setCookieSecure($this->_httpRequest->isSecure());
     }
 
     /**

app/code/Magento/Backend/Test/Unit/Model/Session/AdminConfigTest.php

@@ -105,12 +105,13 @@ public function testSetCookiePathNonDefault()
     }
 
     /**
-     * Test for setting session name for admin
-     *
+     * Test for setting session name and secure_cookie for admin
      */
-    public function testSetSessionNameByConstructor()
+    public function testSetSessionSettingsByConstructor()
     {
         $sessionName = 'admin';
+        $secureRequest = true;
+        $this->requestMock->expects($this->once())->method('isSecure')->willReturn($secureRequest);
 
         $validatorMock = $this->getMockBuilder('Magento\Framework\Validator\ValidatorInterface')
             ->disableOriginalConstructor()
@@ -136,5 +137,6 @@ public function testSetSessionNameByConstructor()
             ]
         );
         $this->assertSame($sessionName, $adminConfig->getName());
+        $this->assertSame($secureRequest, $adminConfig->getCookieSecure());
     }
 }