In m1 we could just override isSecure from Mage_Core_Model_Cookie model, method:

public function isSecure()
    return $this->_getRequest()->isSecure(); 

How can we accomplish this in m2?

enter image description here


Provided you are accessing your site over HTTPS and you have no custom code modifying the cookie secure values, you shouldn't need to modify the core code to serve PHPSESSIONID as secure. As its default behavior

See for example: https://barberblades.co.uk https://www.bathroomsupastore.com

I have not tested this but I believe the Magento 2 equivalent of the code you posted, to force all cookies to the request type would be within:


You could create a Magento Plugin that fires before that method is called returning the result of Magento\Framework\App\RequestInterface->isSecure()

  • I'd rather not modify core code and i kind of like the idea of creating a plugin. I know plugins are rather new in m2 and i've never created one. I'll look into this idea more. But you're saying i could edit those core files too, correct? Additionally, I'm got seeing the getSecure method in those files... i see this method: public function setSecure($secure) { return $this->set(self::KEY_SECURE, $secure); } – Supplement Jun 4 at 22:00
  • Actually, i'm sorrry, i see getSecure in SensitiveCookieMetadata.php but not that first file. @Sam – Supplement Jun 4 at 22:02
  • My bad I've updated my answer to point to the correct file now, the getSecure method in the first file inherited from CookieMetadata. And correct, you could technically modify the core files although I would avoid that since your updates would be lost when you update Magento (also can be a pain to debug if you forget about it). Instead, I would recommend using a custom module with a preference to overwrite the class which would persist across core version updates. See inchoo.net/magento-2/overriding-classes-magento-2 – Sam Jun 4 at 22:09
  • 1
    For SensitiveCookieMetadata you could but would need to inject the request object into CookieMetadata. Then since you modified the constructor in CookieMetadata you would need to rebuild the DI stuff (i use setup:upgrade for that) Example below from Magento Community v2.2.8 gist.github.com/SamJUK/50e3404e9008b0a42dcfae007613f046 – Sam Jun 4 at 22:26
  • 1
    Another thing that comes to mind is, that this sets the cookie secure state based on whether you land on http/https. With redirecting http to https is this done through the option in Magento backend or server config? Potentially if this is done through the Magento backend option, if the user visits example.com Magento may create the session cookie and set it to insecure before redirecting the user to the https site. Best of luck resolving this – Sam Jun 4 at 22:42

You probably looking for class SecurityInfo which implements SecurityInfoInterface in file path;


  • I see the public function that you're speaking of inside that file. public function isSecure($url) << is this what i need to edit to get the check mark for secure?? See above picture that i've added. Thanks in advance. I'll give it a shot. – Supplement Jun 4 at 18:28
  • Can you elaborate on this method @fmsthrid – Supplement Jun 4 at 22:34

You can get whether the URL is secure or not from store manager interface.

Inject \Magento\Store\Model\StoreManagerInterface in your required class and call isFrontUrlSecure() on getStore() function as following.

class ...
    protected $_storeManager;

    public function __construct(      
        \Magento\Store\Model\StoreManagerInterface $storeManager
        $this->_storeManager = $storeManager;        

    public function isFrontUrlSecure()
        return $this->_storeManager->getStore()->isFrontUrlSecure();


You can override Magento\Framework\Stdlib\Cookie\CookieMetadata 's getSecure() function to accomplish the same and magento 2.

You can also try setting this up from the admin too. Go to

Stores > Configuration > General > Web > Default Cookie Settings

and set Use HTTP Only to yes.

  • thank you for contributing but i don't need to know if it's secure or not secure. I can tell it's not secure by looking at the application in inspect element and verifying it's not secure. Please see image above. I think you misunderstood what i'm saying. I'm trying to figure out how i get that little check on "secure" for PHPSESSID. Hope that makes sense. – Supplement Jun 4 at 18:20
  • 1
    I am guessing here that you need to set a secure cookie right? – Vivek Kumar Jun 4 at 18:47
  • Yes, that is correct. @Vivek Kumar – Supplement Jun 4 at 20:18
  • Can you help me accomplish that @Vivek Kumar? – Supplement Jun 4 at 20:44
  • Please check edit – Vivek Kumar Jun 5 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.