Patch-2-of-2-Magento_Checkout-fix-isSecure.patch

--- a/Controller/Index/Index.php
+++ b/Controller/Index/Index.php
@@ -51,18 +51,16 @@ class Index extends \Magento\Checkout\Controller\Onepage
      */
     private function isSecureRequest(): bool
     {
-        $secure = false;
         $request = $this->getRequest();
 
-        if ($request->isSecure()) {
-            $secure = true;
-        }
+        $referrer = $request->getHeader('referer');
+        $secure = false;
 
-        if ($request->getHeader('referer')) {
-            $scheme = parse_url($request->getHeader('referer'), PHP_URL_SCHEME);
+        if ($referrer) {
+            $scheme = parse_url($referrer, PHP_URL_SCHEME);
             $secure = $scheme === 'https';
         }
 
-        return $secure;
+        return $secure && $request->isSecure();
     }
 }


--- a/Test/Unit/Controller/Index/IndexTest.php
+++ b/Test/Unit/Controller/Index/IndexTest.php
@@ -236,26 +236,27 @@ class IndexTest extends \PHPUnit\Framework\TestCase
     public function sessionRegenerationDataProvider(): array
     {
         return [
+            [
+                'secure' => false,
+                'referer' => 'https://test.domain.com/',
+                'expectedCall' => self::once()
+            ],
             [
                 'secure' => true,
                 'referer' => false,
-                'expectedCall' => self::never()
+                'expectedCall' => self::once()
             ],
             [
                 'secure' => true,
-                'referer' => 'https://test.domain.com/',
-                'expectedCall' => self::never()
+                'referer' => 'http://test.domain.com/',
+                'expectedCall' => self::once()
             ],
+            // This is the only case in which session regeneration can be skipped
             [
-                'secure' => false,
+                'secure' => true,
                 'referer' => 'https://test.domain.com/',
                 'expectedCall' => self::never()
             ],
-            [
-                'secure' => true,
-                'referer' => 'http://test.domain.com/',
-                'expectedCall' => self::once()
-            ]
         ];
     }
 
-- 
2.15.0