diff --exclude='*.pyc' --exclude='*.svn' -rupN plone.session-2.1/plone/session/interfaces.py plone.session/plone/session/interfaces.py
--- plone.session-2.1/plone/session/interfaces.py	2009-02-04 23:22:36.000000000 +0000
+++ plone.session/plone/session/interfaces.py	2009-10-20 15:31:16.000000000 +0100
@@ -5,7 +5,7 @@ class ISessionPlugin(Interface):
     Session handling PAS plugin.
     """
 
-    def setupSession(userid, response):
+    def setupSession(userid, response, request):
         """
         Start a new session for a userid. The session will last until
         PAS indicates that the user has logged out.
diff --exclude='*.pyc' --exclude='*.svn' -rupN plone.session-2.1/plone/session/plugins/session.py plone.session/plone/session/plugins/session.py
--- plone.session-2.1/plone/session/plugins/session.py	2009-02-04 23:22:36.000000000 +0000
+++ plone.session/plone/session/plugins/session.py	2009-10-22 15:00:25.000000000 +0100
@@ -1,4 +1,5 @@
-from DateTime import DateTime
+# Add option to set secure bit for all session cookies sent over https
+
 from Products.PageTemplates.PageTemplateFile import PageTemplateFile
 from Products.PluggableAuthService.plugins.BasePlugin import BasePlugin
 from Products.PluggableAuthService.utils import classImplements
@@ -23,9 +24,9 @@ from Products.PluggableAuthService.permi
 manage_addSessionPluginForm = PageTemplateFile('session', globals())
     
 
-def manage_addSessionPlugin(dispatcher, id, title=None, path='/', REQUEST=None):
+def manage_addSessionPlugin(dispatcher, id, title=None, path='/', REQUEST=None, secure=True):
     """Add a session plugin."""
-    sp=SessionPlugin(id, title=title, path=path)
+    sp=SessionPlugin(id, title=title, path=path, secure=secure)
     dispatcher._setObject(id, sp)
 
     if REQUEST is not None:
@@ -42,7 +43,6 @@ class SessionPlugin(BasePlugin):
     meta_type = "Plone Session Plugin"
     security = ClassSecurityInfo()
     cookie_name = "__ac"
-    cookie_lifetime = 0
 
     _properties = (
             {
@@ -57,18 +57,13 @@ class SessionPlugin(BasePlugin):
                 "type"  : "string",
                 "mode"  : "w",
             },
-            {
-                "id"    : "cookie_lifetime",
-                "label" : "Cookie lifetime (in days)",
-                "type"  : "int",
-                "mode"  : "w",
-            },
             )
 
-    def __init__(self, id, title=None, path="/"):
+    def __init__(self, id, title=None, path="/", secure=True):
         self._setId(id)
         self.title=title
         self.path=path
+        self.secure=secure
 
     @property
     def source(self):
@@ -89,16 +84,29 @@ class SessionPlugin(BasePlugin):
 
 
     # ISessionPlugin implementation
-    security.declareProtected(ManageUsers, 'setupSession')
-    def setupSession(self, userid, response):
+    def setupSession(self, userid, response, request):
+        #self.plone_log('setupSession: START')
+        
         cookie=self.source.createIdentifier(userid)
         cookie=binascii.b2a_base64(cookie).rstrip()
-
-        if isinstance(self.cookie_lifetime, int) and self.cookie_lifetime:
-            expires = (DateTime() + self.cookie_lifetime).toZone('GMT').rfc822()
-            response.setCookie(self.cookie_name, cookie, path=self.path, expires=expires)
+        secure = False
+         
+        if self.secure:
+
+            s_url = request.get('SERVER_URL', None)
+            
+            #self.plone_log("setupSession: SERVER_URL: %s" % s_url)
+            
+            #Only set secure bit of cookie if currently over https
+            if s_url is not None and s_url.startswith('https'):
+                secure = True
+        
+        if secure:
+            response.setCookie(self.cookie_name, cookie, path=self.path, secure=True)
         else:
             response.setCookie(self.cookie_name, cookie, path=self.path)
+            
+        #self.plone_log('setupSession: END')
 
 
     # IExtractionPlugin implementation
@@ -139,11 +147,16 @@ class SessionPlugin(BasePlugin):
 
     # ICredentialsUpdatePlugin implementation
     def updateCredentials(self, request, response, login, new_password):
+        #self.plone_log('updateCredentials: START')
+        
         pas=self._getPAS()
         info=pas._verifyUser(pas.plugins, login=login)
         if info is not None:
             # Only setup a session for users in our own user folder.
-            self.setupSession(info["id"], response)
+            self.setupSession(info["id"], response, request)
+            
+        #self.plone_log('updateCredentials: END')
+    
 
 
     # ICredentialsResetPlugin implementation
diff --exclude='*.pyc' --exclude='*.svn' -rupN plone.session-2.1/plone/session/plugins/session.zpt plone.session/plone/session/plugins/session.zpt
--- plone.session-2.1/plone/session/plugins/session.zpt	2009-02-04 23:22:36.000000000 +0000
+++ plone.session/plone/session/plugins/session.zpt	2009-10-20 16:10:48.000000000 +0100
@@ -42,6 +42,16 @@
     </tr>
     <tr>
       <td align="left" valign="top">
+        <div class="form-optional">
+          Cookie Secure
+        </div>
+      </td>
+      <td align="left" valign="top">
+        <input type="checkbox" name="secure:boolean" checked="1" />
+      </td>
+    </tr>        
+    <tr>
+      <td align="left" valign="top">
       </td>
       <td align="left" valign="top">
         <div class="form-element">