diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/web/CookieBasedCsrfTokenRepositoryTests.java b/server/src/test/java/org/cloudfoundry/identity/uaa/web/CookieBasedCsrfTokenRepositoryTests.java
index <HASH>..<HASH> 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/web/CookieBasedCsrfTokenRepositoryTests.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/web/CookieBasedCsrfTokenRepositoryTests.java
@@ -138,6 +138,7 @@ public class CookieBasedCsrfTokenRepositoryTests {
         CookieBasedCsrfTokenRepository repo = new CookieBasedCsrfTokenRepository();
         repo.setSecure(isSecure);
         MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setProtocol("http");
         MockHttpServletResponse response = new MockHttpServletResponse();
         CsrfToken token = repo.generateToken(request);
         repo.saveToken(token, request, response);
refactor: make protocol default explicit