better checking for SSL servers, even though it probably doesn't fix the cookie bug

1 files changed, 1 insertions, 1 deletions

diff --git a/index.php b/index.php
index ed3c25f07..a07c1a633 100755
--- a/index.php
+++ b/index.php
@@ -63,7 +63,7 @@ if(! $a->install) {
 			((isset($arr['lifetime']))  ? $arr['lifetime'] : 60*5),
 			((isset($arr['path']))      ? $arr['path']     : '/'),
 			((isset($arr['domain']))    ? $arr['domain']   : $a->get_hostname()),
-			((isset($_SERVER['HTTPS'])) ? true             : false),
+			((isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') ? true : false),
 			((isset($arr['httponly']))  ? $arr['httponly'] : true));
 	}
 }