fix: refresh cookie attributes for rolling sessions

index.js

@@ -158,19 +158,26 @@ function session(options) {
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions;
-    req.session.cookie = new Cookie(resolvedCookieOptions);
+    req.session.cookie = createCookie(req);
+  };
 
+  // create a new cookie for the request from
+  // the resolved cookie options
+  function createCookie(req) {
+    var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions;
+    var sessionCookie = new Cookie(resolvedCookieOptions);
     var isSecure = issecure(req, trustProxy);
 
     if (resolvedCookieOptions.secure === 'auto') {
-      req.session.cookie.secure = isSecure;
+      sessionCookie.secure = isSecure;
     }
 
     if (resolvedCookieOptions.sameSite === 'auto') {
-      req.session.cookie.sameSite = isSecure ? 'none' : 'lax';
+      sessionCookie.sameSite = isSecure ? 'none' : 'lax';
     }
-  };
+
+    return sessionCookie;
+  }
 
   var storeImplementsTouch = typeof store.touch === 'function';
 
@@ -389,6 +396,18 @@ function session(options) {
     // inflate the session
     function inflate (req, sess) {
       store.createSession(req, sess)
+
+      if (rollingSessions) {
+        // refresh the cookie attributes from the current
+        // options, keeping the session's own expiration
+        var expires = req.session.cookie.expires
+        var originalMaxAge = req.session.cookie.originalMaxAge
+
+        req.session.cookie = createCookie(req)
+        req.session.cookie.expires = expires
+        req.session.cookie.originalMaxAge = originalMaxAge
+      }
+
       originalId = req.sessionID
       originalHash = hash(sess)
 

test/session.js

@@ -1229,6 +1229,68 @@ describe('session()', function(){
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, done);
     });
+
+    it('should send updated cookie attributes on existing session', function (done) {
+      var store = new session.MemoryStore()
+      var server = createServer({
+        cookie: { maxAge: 60000, sameSite: 'none' },
+        rolling: true,
+        store: store
+      }, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
+
+      request(server)
+      .get('/')
+      .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+      .expect(200, function (err, res) {
+        if (err) return done(err)
+
+        var updatedServer = createServer({
+          cookie: { maxAge: 120000, sameSite: 'strict' },
+          rolling: true,
+          store: store
+        })
+
+        request(updatedServer)
+        .get('/')
+        .set('Cookie', cookie(res))
+        .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Strict'))
+        .expect(shouldSetCookieToExpireIn('connect.sid', 60000))
+        .expect(200, done)
+      })
+    })
+
+    it('should honor session cookie changes on existing session', function (done) {
+      var store = new session.MemoryStore()
+      var server = createServer({ rolling: true, store: store }, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
+
+      request(server)
+      .get('/')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, function (err, res) {
+        if (err) return done(err)
+
+        var updatedServer = createServer({
+          cookie: { maxAge: 120000, sameSite: 'strict' },
+          rolling: true,
+          store: store
+        }, function (req, res) {
+          req.session.cookie.sameSite = 'lax'
+          res.end()
+        })
+
+        request(updatedServer)
+        .get('/')
+        .set('Cookie', cookie(res))
+        .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+        .expect(200, done)
+      })
+    })
   });
 
   describe('resave option', function(){