diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 6a96d421da..6451207d2d 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -68,7 +68,8 @@ export async function createRouter(
   if (secret) {
     router.use(cookieParser(secret));
     // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
-    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    const enforceCookieSSL = process.env.NODE_ENV === 'production';
+    router.use(session({ secret, saveUninitialized: false, resave: false, cookie: { secure: enforceCookieSSL } }));
     router.use(passport.initialize());
     router.use(passport.session());
   } else {