Repository: quarkusio/quarkus
Issue: Form based authentication cookie will soon be rejected

**Describe the bug**
I register it as a bug because soon it won't work anymore.

Using the Form Based Authentication, a cookie is created, with default name "quarkus-credential". Doing so, Firefox warns:
`Cookie “quarkus-credential” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite`

I followed the tutorial: http://fxapps.blogspot.com/2019/12/quarkus-application-with-form.html

**Expected behavior**
We should be able to customize the cookie attributes, at least "SameSite" and "Secure".

**Actual behavior**
We can only customize the cookie name using "quarkus.http.auth.form.cookie-name".

**Configuration**
```properties
quarkus.http.auth.form.enabled=true
quarkus.security.jdbc.enabled=true
quarkus.security.jdbc.principal-query.datasource=auth
quarkus.security.jdbc.principal-query.sql=SELECT password FROM users u WHERE u.login=?
quarkus.security.jdbc.principal-query.bcrypt-password-mapper.enabled=true
quarkus.security.jdbc.principal-query.bcrypt-password-mapper.password-index=1
quarkus.security.jdbc.principal-query.bcrypt-password-mapper.iteration-count-index=-1
quarkus.security.jdbc.principal-query.bcrypt-password-mapper.salt-index=-1
quarkus.security.jdbc.principal-query.roles.sql=select r.name as role_name from roles r, (select m.role_id from assigned_role m join user u on m.user_id = u.id and u.login = ?) a where r.id >= a.role_id
quarkus.security.jdbc.principal-query.roles.datasource=auth
quarkus.security.jdbc.principal-query.roles.attribute-mappings.0.index=1
quarkus.security.jdbc.principal-query.roles.attribute-mappings.0.to=groups
quarkus.http.auth.permission.permit1.paths=/secured/*
quarkus.http.auth.permission.permit1.policy=authenticated
```

**Environment (please complete the following information):**
 - Output of `uname -a` or `ver`: Linux netwave-lolo 5.4.0-48-generic #52-Ubuntu SMP Thu Sep 10 10:58:49 UTC 2020 x86_64 x86_64 x86_64 GNU/Linu
 - Output of `java -version`: openjdk version "1.8.0_252"
OpenJDK Runtime Environment (AdoptOpenJDK)(build 1.8.0_252-b09)
OpenJDK 64-Bit Server VM (AdoptOpenJDK)(build 25.252-b09, mixed mode)
 - GraalVM version (if different from Java): -
 - Quarkus version or git rev: 1.8.1
 - Build tool (ie. output of `mvnw --version` or `gradlew --version`): Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)


Changed files:
extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/FormAuthenticationMechanism.java
extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/PersistentLoginManager.java
extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/security/FormAuthTestCase.java

diff --git a/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/security/FormAuthTestCase.java b/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/security/FormAuthTestCase.java
index b61dd75a9f8..c8985925854 100644
--- a/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/security/FormAuthTestCase.java
+++ b/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/security/FormAuthTestCase.java
@@ -18,6 +18,7 @@
 import io.quarkus.test.QuarkusUnitTest;
 import io.restassured.RestAssured;
 import io.restassured.filter.cookie.CookieFilter;
+import io.restassured.matcher.RestAssuredMatchers;
 
 public class FormAuthTestCase {
 
@@ -60,7 +61,8 @@ public void testFormBasedAuthSuccess() {
                 .assertThat()
                 .statusCode(302)
                 .header("location", containsString("/login"))
-                .cookie("quarkus-redirect-location", containsString("/admin"));
+                .cookie("quarkus-redirect-location",
+                        RestAssuredMatchers.detailedCookie().value(containsString("/admin")).secured(false));
 
         RestAssured
                 .given()
@@ -74,7 +76,8 @@ public void testFormBasedAuthSuccess() {
                 .assertThat()
                 .statusCode(302)
                 .header("location", containsString("/admin"))
-                .cookie("quarkus-credential", notNullValue());
+                .cookie("quarkus-credential",
+                        RestAssuredMatchers.detailedCookie().value(notNullValue()).secured(false));
 
         RestAssured
                 .given()
diff --git a/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/FormAuthenticationMechanism.java b/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/FormAuthenticationMechanism.java
index 74d6962fb87..062965097f7 100644
--- a/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/FormAuthenticationMechanism.java
+++ b/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/FormAuthenticationMechanism.java
@@ -75,7 +75,7 @@ public void handle(Void event) {
                                         @Override
                                         public void accept(SecurityIdentity identity) {
                                             try {
-                                                loginManager.save(identity, exchange, null);
+                                                loginManager.save(identity, exchange, null, exchange.request().isSSL());
                                                 if (redirectAfterLogin || exchange.getCookie(locationCookie) != null) {
                                                     handleRedirectBack(exchange);
                                                     //we  have authenticated, but we want to just redirect back to the original page
@@ -111,6 +111,7 @@ protected void handleRedirectBack(final RoutingContext exchange) {
         Cookie redirect = exchange.getCookie(locationCookie);
         String location;
         if (redirect != null) {
+            redirect.setSecure(exchange.request().isSSL());
             location = redirect.getValue();
             exchange.response().addCookie(redirect.setMaxAge(0));
         } else {
@@ -122,7 +123,8 @@ protected void handleRedirectBack(final RoutingContext exchange) {
     }
 
     protected void storeInitialLocation(final RoutingContext exchange) {
-        exchange.response().addCookie(Cookie.cookie(locationCookie, exchange.request().absoluteURI()).setPath("/"));
+        exchange.response().addCookie(Cookie.cookie(locationCookie, exchange.request().absoluteURI())
+                .setPath("/").setSecure(exchange.request().isSSL()));
     }
 
     protected void servePage(final RoutingContext exchange, final String location) {
@@ -152,7 +154,7 @@ public Uni<SecurityIdentity> authenticate(RoutingContext context,
             return ret.onItem().invoke(new Consumer<SecurityIdentity>() {
                 @Override
                 public void accept(SecurityIdentity securityIdentity) {
-                    loginManager.save(securityIdentity, context, result);
+                    loginManager.save(securityIdentity, context, result, context.request().isSSL());
                 }
             });
         }
diff --git a/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/PersistentLoginManager.java b/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/PersistentLoginManager.java
index f6da62631fb..580e771af0a 100644
--- a/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/PersistentLoginManager.java
+++ b/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/PersistentLoginManager.java
@@ -37,10 +37,10 @@ public class PersistentLoginManager {
     private final long newCookieIntervalMillis;
 
     public PersistentLoginManager(String encryptionKey, String cookieName, long timeoutMillis, long newCookieIntervalMillis) {
+        this.cookieName = cookieName;
+        this.newCookieIntervalMillis = newCookieIntervalMillis;
+        this.timeoutMillis = timeoutMillis;
         try {
-            this.cookieName = cookieName;
-            this.newCookieIntervalMillis = newCookieIntervalMillis;
-            this.timeoutMillis = timeoutMillis;
             if (encryptionKey == null) {
                 this.secretKey = KeyGenerator.getInstance("AES").generateKey();
             } else if (encryptionKey.length() < 16) {
@@ -99,7 +99,7 @@ public RestoreResult restore(RoutingContext context) {
         }
     }
 
-    public void save(SecurityIdentity identity, RoutingContext context, RestoreResult restoreResult) {
+    public void save(SecurityIdentity identity, RoutingContext context, RestoreResult restoreResult, boolean secureCookie) {
         if (restoreResult != null) {
             if (!restoreResult.newCookieNeeded) {
                 return;
@@ -122,7 +122,7 @@ public void save(SecurityIdentity identity, RoutingContext context, RestoreResul
             message.put(iv);
             message.put(encrypted);
             String cookieValue = Base64.getEncoder().encodeToString(message.array());
-            context.addCookie(Cookie.cookie(cookieName, cookieValue).setPath("/"));
+            context.addCookie(Cookie.cookie(cookieName, cookieValue).setPath("/").setSecure(secureCookie));
         } catch (Exception e) {
             throw new RuntimeException(e);
         }