An issue exists in Mattermost Server prior to 3.0.0. It does not ensure that a cookie is used over SSL.
mattermost mattermost server