diff --git a/jsts/jst_prefix.js b/jsts/jst_prefix.js
index 8f3a778..ed4ddcc 100644
--- a/jsts/jst_prefix.js
+++ b/jsts/jst_prefix.js
@@ -89,6 +89,17 @@ var $_SERVER = new Proxy({}, {
 var $_SESSION = {};
 var $_jst_session = null;
 var $_val_input = {};
+
+function is_https_request()
+{
+  var https = getenv('HTTPS');
+  if(https === false || https === undefined || https === null)
+    return false;
+
+  var value = String(https).toLowerCase();
+  return (value === 'on' || value === '1' || value === 'true');
+}
+
 function session_start()
 {
   if($_jst_session)
@@ -99,12 +110,8 @@ function session_start()
     return;
   }
   ccsp_session.start();
-  var host = getenv('HTTPS');
-  if (host == false)
-      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
-  else
-      var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
-  header($cookie);
+  var cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; HttpOnly" + (is_https_request() ? "; Secure" : "");
+  header(cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
@@ -127,12 +134,8 @@ function session_start()
 }
 function session_create(){
   ccsp_session.create();
-  var host = getenv('HTTPS');
-  if (host == false)
-    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly";
-  else
-    var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly";
-  header($cookie);
+  var cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; HttpOnly" + (is_https_request() ? "; Secure" : "");
+  header(cookie);
   $_jst_session = ccsp_session.getData();
   $_SESSION = new Proxy($_jst_session, {
     get: function(obj, prop) {
diff --git a/source/jst_session.c b/source/jst_session.c
index 69f542f..c1074d3 100644
--- a/source/jst_session.c
+++ b/source/jst_session.c
@@ -148,6 +148,8 @@ static duk_ret_t session_start(duk_context *ctx)
   if(!session_identifier[0])
   {
    CosaPhpExtLog("Invalid Session\n");
+   free(session_identifier);
+   session_identifier = NULL;
    RETURN_FALSE;
   }