MAGETWO-50234: Transmission of Private Resources into a New Sphere ('Resource Leak')

- When persistent cookie is deleted, deletion process uses http-only also now.

Author: Hayder Sharhan

app/code/Magento/Persistent/Model/Session.php

@@ -289,7 +289,7 @@ public function deleteByCustomerId($customerId, $clearCookie = true)
      */
     public function removePersistentCookie()
     {
-        $cookieMetadata = $this->_cookieMetadataFactory->createCookieMetadata()
+        $cookieMetadata = $this->_cookieMetadataFactory->createSensitiveCookieMetadata()
             ->setPath($this->sessionConfig->getCookiePath());
         $this->_cookieManager->deleteCookie(self::COOKIE_NAME, $cookieMetadata);
         return $this;

app/code/Magento/Persistent/Test/Unit/Model/SessionTest.php

@@ -91,15 +91,15 @@ public function testAfterDeleteCommit()
     {
         $cookiePath = 'some_path';
         $this->configMock->expects($this->once())->method('getCookiePath')->will($this->returnValue($cookiePath));
-        $cookieMetadataMock = $this->getMockBuilder('Magento\Framework\Stdlib\Cookie\CookieMetadata')
+        $cookieMetadataMock = $this->getMockBuilder('Magento\Framework\Stdlib\Cookie\SensitiveCookieMetadata')
             ->disableOriginalConstructor()
             ->getMock();
         $cookieMetadataMock->expects($this->once())
             ->method('setPath')
             ->with($cookiePath)
             ->will($this->returnSelf());
         $this->cookieMetadataFactoryMock->expects($this->once())
-            ->method('createCookieMetadata')
+            ->method('createSensitiveCookieMetadata')
             ->will($this->returnValue($cookieMetadataMock));
         $this->cookieManagerMock->expects(
             $this->once()