Repository: quarkusio/quarkus
Issue: OIDC CodeAuthentitcationMechanism does not set state and session cookies 'secure` parameter to true if 'force-redirect-https-scheme' is enabled

**Description**
As reported at https://quarkusio.zulipchat.com/#narrow/stream/187030-users/topic/OIDC.20Session.20Cookie.20-.20Samesite.20.20Policy, the state and session cookies do not have `secure=true` as a result

Changed files:
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java

diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java
index 6c02d5de2f0..306b5b4fe32 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java
@@ -444,6 +444,14 @@ public static class Authentication {
         @ConfigItem
         public Map<String, String> extraParams;
 
+        /**
+         * If enabled the state, session and post logout cookies will have their 'secure' parameter set to 'true'
+         * when HTTP is used. It may be necessary when running behind an SSL terminating reverse proxy.
+         * The cookies will always be secure if HTTPS is used even if this property is set to false.
+         */
+        @ConfigItem(defaultValue = "false")
+        public boolean cookieForceSecure;
+
         /**
          * Cookie path parameter value which, if set, will be used to set a path parameter for the session, state and post
          * logout cookies.
@@ -543,6 +551,14 @@ public void setRestorePathAfterRedirect(boolean restorePathAfterRedirect) {
             this.restorePathAfterRedirect = restorePathAfterRedirect;
         }
 
+        public boolean isCookieForceSecure() {
+            return cookieForceSecure;
+        }
+
+        public void setCookieForceSecure(boolean cookieForceSecure) {
+            this.cookieForceSecure = cookieForceSecure;
+        }
+
         public Optional<String> getCookiePath() {
             return cookiePath;
         }
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
index 8f81d6c8e64..2302c87f802 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
@@ -423,7 +423,7 @@ static ServerCookie createCookie(RoutingContext context, OidcTenantConfig oidcCo
             String name, String value, long maxAge) {
         ServerCookie cookie = new CookieImpl(name, value);
         cookie.setHttpOnly(true);
-        cookie.setSecure(context.request().isSSL());
+        cookie.setSecure(oidcConfig.authentication.cookieForceSecure || context.request().isSSL());
         cookie.setMaxAge(maxAge);
         LOG.debugf(name + " cookie 'max-age' parameter is set to %d", maxAge);
         Authentication auth = oidcConfig.getAuthentication();