We recently applied Pega patch version 8.2.8 on our Pega Customer service application that was previously on Pega 8.2.5. After application of the patch, we are not able to access the Login screen of the Pega application through our Http URL (it was previously accessible in Pega 8.2.5 version).

When we debugged it a little bit we noticed that when we hit the Http request, the server is responding back with only JSessionID cookie set. It is not setting the PEGA-RULES cookie.

When we access the same application using https URL, both the JSessionID and PEGA-RULES cookie is being set.

Can someone please provide some insight what must have triggered the patched application to not set PEGA-RULES cookie in http requests. As mentioned before, both the http and https requests were working fine in Pega 8.2.5.

We are running JBoss application server 7.3 with Oracle JDK and DB2 database. 

Thanks in advance