Support the value "auto" in the "cookie.secure" option

closes expressjs#209

Author: fracmak

HISTORY.md

@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Support the value `'auto'` in the `cookie.secure` option
   * deps: cookie@0.2.2
     - Throw on invalid values provided to `serialize`
   * deps: depd@~1.1.0

README.md

@@ -192,6 +192,13 @@ if (app.get('env') === 'production') {
 app.use(session(sess))
 ```
 
+The `cookie.secure` option can also be set to the special value `'auto'` to have
+this setting automatically match the determined security of the connection. Be
+careful when using this setting if the site is available both as HTTP and HTTPS,
+as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This
+is useful when the Express `"trust proxy"` setting is properly setup to simplify
+development vs production configuration.
+
 By default `cookie.maxAge` is `null`, meaning no "expires" parameter is set
 so the cookie becomes a browser-session cookie. When the user closes the
 browser the cookie (and session) will be removed.

index.js

@@ -86,10 +86,10 @@ function session(options){
   //  name - previously "options.key"
     , name = options.name || options.key || 'connect.sid'
     , store = options.store || new MemoryStore
-    , cookie = options.cookie || {}
     , trustProxy = options.proxy
     , storeReady = true
     , rollingSessions = options.rolling || false;
+  var cookieOptions = options.cookie || {};
   var resaveSession = options.resave;
   var saveUninitializedSession = options.saveUninitialized;
   var secret = options.secret;
@@ -139,7 +139,11 @@ function session(options){
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    req.session.cookie = new Cookie(cookie);
+    req.session.cookie = new Cookie(cookieOptions);
+
+    if (cookieOptions.secure === 'auto') {
+      req.session.cookie.secure = issecure(req, trustProxy);
+    }
   };
 
   var storeImplementsTouch = typeof store.touch === 'function';
@@ -156,7 +160,7 @@ function session(options){
 
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname;
-    if (0 != originalPath.indexOf(cookie.path || '/')) return next();
+    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) return next();
 
     // ensure a secret is available or bail
     if (!secret && !req.secret) {

test/session.js

@@ -638,6 +638,67 @@ describe('session()', function(){
     })
   })
 
+  describe('cookie option', function () {
+    describe('when "secure" set to "auto"', function () {
+      describe('when "proxy" is "true"', function () {
+        before(function () {
+          this.server = createServer({ proxy: true, cookie: { maxAge: 5, secure: 'auto' }})
+        })
+
+        it('should set secure when X-Forwarded-Proto is https', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Forwarded-Proto', 'https')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldSetSecureCookie('connect.sid'))
+          .expect(200, done)
+        })
+      })
+
+      describe('when "proxy" is "false"', function () {
+        before(function () {
+          this.server = createServer({ proxy: false, cookie: { maxAge: 5, secure: 'auto' }})
+        })
+
+        it('should not set secure when X-Forwarded-Proto is https', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Forwarded-Proto', 'https')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldNotSetSecureCookie('connect.sid'))
+          .expect(200, done)
+        })
+      })
+
+      describe('when "proxy" is undefined', function() {
+        before(function () {
+          this.app = express()
+            .use(function(req, res, next) { Object.defineProperty(req, 'secure', { value: JSON.parse(req.headers['x-secure']) }); next(); })
+            .use(session({ secret: 'keyboard cat', cookie: { maxAge: min, secure: 'auto' }}))
+            .use(function(req, res) { res.json(req.secure); });
+        })
+
+        it('should set secure if req.secure = true', function (done) {
+          request(this.app)
+          .get('/')
+          .set('X-Secure', 'true')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldSetSecureCookie('connect.sid'))
+          .expect(200, 'true', done)
+        })
+
+        it('should not set secure if req.secure = false', function (done) {
+          request(this.app)
+          .get('/')
+          .set('X-Secure', 'false')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldNotSetSecureCookie('connect.sid'))
+          .expect(200, 'false', done)
+        })
+      })
+    })
+  })
+
   describe('genid option', function(){
     it('should reject non-function values', function(){
       assert.throws(session.bind(null, { genid: 'bogus!' }), /genid.*must/)
@@ -2055,6 +2116,15 @@ function shouldNotHaveHeader(header) {
   }
 }
 
+function shouldNotSetSecureCookie(name) {
+  return function (res) {
+    var header = cookie(res)
+    assert.ok(header, 'should have a cookie header')
+    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
+    assert.ok(header.toLowerCase().split(/; */).every(function (k) { return k !== 'secure'; }), 'should not set secure cookie')
+  }
+}
+
 function shouldSetCookie(name) {
   return function (res) {
     var header = cookie(res)
@@ -2072,6 +2142,15 @@ function shouldSetCookieToValue(name, val) {
   }
 }
 
+function shouldSetSecureCookie(name) {
+  return function (res) {
+    var header = cookie(res)
+    assert.ok(header, 'should have a cookie header')
+    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
+    assert.ok(header.toLowerCase().split(/; */).some(function (k) { return k === 'secure'; }), 'should set secure cookie')
+  }
+}
+
 function sid(res) {
   var match = /^[^=]+=s%3A([^;\.]+)[\.;]/.exec(cookie(res))
   var val = match ? match[1] : undefined