From 53d690c28e2a5259a30534951da06357ce86f24e Mon Sep 17 00:00:00 2001
From: James Nord <jtnord@users.noreply.github.com>
Date: Tue, 12 Oct 2021 14:11:57 +0100
Subject: [PATCH] [JENKINS-49675] Mark the cookie as secure when serving via
 HTTPS (#5788)

---
 .../main/resources/hudson/model/View/index.jelly    | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/core/src/main/resources/hudson/model/View/index.jelly b/core/src/main/resources/hudson/model/View/index.jelly
index f53d03ee48..5ab71ed6dd 100644
--- a/core/src/main/resources/hudson/model/View/index.jelly
+++ b/core/src/main/resources/hudson/model/View/index.jelly
@@ -44,11 +44,14 @@ THE SOFTWARE.
         <l:header>
             <!-- for screen resolution detection -->
             <l:yui module="cookie" />
-            <script>
-              YAHOO.util.Cookie.set("screenResolution", screen.width+"x"+screen.height, {
-                path: "/"
-              });
-            </script>
+                <script id="screenResolution-script" data-use-secure-cookie="${request.secure}">
+                  var selfScript = document.querySelector('#screenResolution-script');
+                  var secureCookie = selfScript.getAttribute('data-use-secure-cookie');
+                  YAHOO.util.Cookie.set("screenResolution", screen.width+"x"+screen.height, {
+                    path: "/",
+                    secure: secureCookie === 'true'
+                  });
+                </script>
         </l:header>
     </l:layout>
 </st:compress>