Fix CookieClearingLogoutHandler cookie secure flag:

It is better to mark cookie secure flag with request.isSecure() to ensure cookie identity is same

Author: okohub

web/src/main/java/org/springframework/security/web/authentication/logout/CookieClearingLogoutHandler.java

@@ -32,6 +32,7 @@
  * - A given list of Cookies
  *
  * @author Luke Taylor
+ * @author Onur Kagan Ozcan
  * @since 3.1
  */
 public final class CookieClearingLogoutHandler implements LogoutHandler {
@@ -46,6 +47,7 @@ public CookieClearingLogoutHandler(String... cookiesToClear) {
 				String cookiePath = request.getContextPath() + "/";
 				cookie.setPath(cookiePath);
 				cookie.setMaxAge(0);
+				cookie.setSecure(request.isSecure());
 				return cookie;
 			};
 			cookieList.add(f);

web/src/test/java/org/springframework/security/web/authentication/logout/CookieClearingLogoutHandlerTests.java

@@ -27,6 +27,7 @@
 
 /**
  * @author Luke Taylor
+ * @author Onur Kagan Ozcan
  */
 public class CookieClearingLogoutHandlerTests {
 
@@ -61,6 +62,18 @@ public void configuredCookiesAreCleared() {
 		}
 	}
 
+	@Test
+	public void configuredCookieIsSecure() {
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setSecure(true);
+		request.setContextPath("/app");
+		CookieClearingLogoutHandler handler = new CookieClearingLogoutHandler("my_cookie");
+		handler.logout(request, response, mock(Authentication.class));
+		assertThat(response.getCookies()).hasSize(1);
+		assertThat(response.getCookies()[0].getSecure()).isTrue();
+	}
+
 	@Test
 	public void passedInCookiesAreCleared() {
 		MockHttpServletResponse response = new MockHttpServletResponse();