From 1321162b69148f249b4e5d3e6496ebefc8683c70 Mon Sep 17 00:00:00 2001
From: Raashish Aggarwal <94279692+raashish1601@users.noreply.github.com>
Date: Sat, 30 May 2026 16:23:16 +0530
Subject: [PATCH 1/2] fix: detect secure socket when connection is missing

---
 index.js        |  4 ++++
 test/session.js | 15 +++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/index.js b/index.js
index 41f9447f..b15fe5e6 100644
--- a/index.js
+++ b/index.js
@@ -681,6 +681,10 @@ function issecure(req, trustProxy) {
     return true;
   }
 
+  if (req.socket && req.socket.encrypted) {
+    return true;
+  }
+
   // do not trust proxy
   if (trustProxy === false) {
     return false;
diff --git a/test/session.js b/test/session.js
index 330c4137..07bfc138 100644
--- a/test/session.js
+++ b/test/session.js
@@ -888,6 +888,21 @@ describe('session()', function(){
           .expect(200, 'true', done);
       });
     });
+
+    describe('when request socket is encrypted', function () {
+      it('should treat request as secure when connection is missing', function (done) {
+        function setup (req) {
+          req.connection = null
+          req.socket = { encrypted: true }
+        }
+
+        request(createServer(setup, { cookie: { secure: true } }))
+          .get('/')
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          .expect(200, done)
+      })
+    })
+
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
         before(function () {

From a039e72cd54b7eb36a8bd70c4b3ec37e1253066d Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Sun, 5 Jul 2026 21:21:49 -0500
Subject: [PATCH 2/2] fix: improve secure socket detection logic in session
 handling

---
 index.js        |  7 ++-----
 test/session.js | 38 +++++++++++++++++++++++++-------------
 2 files changed, 27 insertions(+), 18 deletions(-)

diff --git a/index.js b/index.js
index b15fe5e6..eb15ea64 100644
--- a/index.js
+++ b/index.js
@@ -677,11 +677,8 @@ function hash(sess) {
 
 function issecure(req, trustProxy) {
   // socket is https server
-  if (req.connection && req.connection.encrypted) {
-    return true;
-  }
-
-  if (req.socket && req.socket.encrypted) {
+  var socket = req.socket || req.connection;
+  if (socket && socket.encrypted) {
     return true;
   }
 
diff --git a/test/session.js b/test/session.js
index 07bfc138..abf846f5 100644
--- a/test/session.js
+++ b/test/session.js
@@ -800,6 +800,31 @@ describe('session()', function(){
           .expect(200, 'false', done)
         })
       })
+
+      describe('when request socket is encrypted', function () {
+        it('should set secure over TLS', function (done) {
+          var cert = fs.readFileSync(__dirname + '/fixtures/server.crt', 'ascii')
+          var server = https.createServer({
+            key: fs.readFileSync(__dirname + '/fixtures/server.key', 'ascii'),
+            cert: cert
+          })
+
+          server.on('request', createRequestListener({ secret: 'keyboard cat', cookie: { secure: 'auto' } }))
+
+          var agent = new https.Agent({ ca: cert })
+          var createConnection = agent.createConnection
+
+          agent.createConnection = function (options) {
+            options.servername = 'express-session.local'
+            return createConnection.call(this, options)
+          }
+
+          var req = request(server).get('/')
+          req.agent(agent)
+          req.expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          req.expect(200, done)
+        })
+      })
     })
 
     describe('when "cookie" is a function', function () {
@@ -889,19 +914,6 @@ describe('session()', function(){
       });
     });
 
-    describe('when request socket is encrypted', function () {
-      it('should treat request as secure when connection is missing', function (done) {
-        function setup (req) {
-          req.connection = null
-          req.socket = { encrypted: true }
-        }
-
-        request(createServer(setup, { cookie: { secure: true } }))
-          .get('/')
-          .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
-          .expect(200, done)
-      })
-    })
 
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {