diff --git a/core/lib/Drupal/Core/Session/SessionConfiguration.php b/core/lib/Drupal/Core/Session/SessionConfiguration.php
index afa3666..5d17329 100644
--- a/core/lib/Drupal/Core/Session/SessionConfiguration.php
+++ b/core/lib/Drupal/Core/Session/SessionConfiguration.php
@@ -52,6 +52,12 @@ public function getOptions(Request $request) {
       $options['cookie_domain'] = $cookie_domain;
     }
 
+    // If the site is accessed via SSL, ensure that the session cookie is
+    // issued with the secure flag.
+    if ($request->isSecure()) {
+      $options['cookie_secure'] = TRUE;
+    }
+
     $options['name'] = $this->getName($request);
 
     return $options;