[ForwardPort 2.3-develop] Fix \Magento\Checkout\Controller\Index\Index::isSecureRequest method to take care of current request being secure and also from referer, as stated in phpdoc block

[adrian-martinez-interactiv4]

Related with PR #14428

Description

Fix \Magento\Checkout\Controller\Index\Index::isSecureRequest method to take care of current request being secure and also from referer, as stated in phpdoc block.

After last try to implement a solution for session loss in checkout, this private method did behaviour as expected. Updated as agreed with @sidolov .

Fixed Issues (if relevant)

1. Hit fast twice F5 on checout page, customer loggs out automatically #4301: Hit fast twice F5 on checout page, customer loggs out automatically
2. Concurrent (quick reload) requests on checkout cause cart to empty - related to session_regenerate_id #12362: Concurrent (quick reload) requests on checkout cause cart to empty - related to session_regenerate_id
3. [2.1.11] Add to cart, try to checkout, cart is empty but mini-cart has items. #13427: Add to cart, try to checkout, cart is empty but mini-cart has items.

Contribution checklist

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds on Travis CI are green)

[sidolov]

Hi @adrian-martinez-interactiv4 , regenerate_session_id call was added in order to prevent session fixation attacks. Atack possible when browsing between secure and insecure pages. We can’t remove the line in question as it may theoretically compromise security.

We have the story for implementation secure cookies and session transfer mechanism.

For now, I propose to leave a comment under the line with regenerate_session_id call with an explanation why it was added.

[magento-engcom-team]

Hi @adrian-martinez-interactiv4. Thank you for your contribution.
Changes from your Pull Request will be available with the upcoming 2.3.0 release.