fix: detect secure socket when connection is missing

index.js

@@ -677,7 +677,8 @@ function hash(sess) {
 
 function issecure(req, trustProxy) {
   // socket is https server
-  if (req.connection && req.connection.encrypted) {
+  var socket = req.socket || req.connection;
+  if (socket && socket.encrypted) {
     return true;
   }
 

test/session.js

@@ -800,6 +800,31 @@ describe('session()', function(){
           .expect(200, 'false', done)
         })
       })
+
+      describe('when request socket is encrypted', function () {
+        it('should set secure over TLS', function (done) {
+          var cert = fs.readFileSync(__dirname + '/fixtures/server.crt', 'ascii')
+          var server = https.createServer({
+            key: fs.readFileSync(__dirname + '/fixtures/server.key', 'ascii'),
+            cert: cert
+          })
+
+          server.on('request', createRequestListener({ secret: 'keyboard cat', cookie: { secure: 'auto' } }))
+
+          var agent = new https.Agent({ ca: cert })
+          var createConnection = agent.createConnection
+
+          agent.createConnection = function (options) {
+            options.servername = 'express-session.local'
+            return createConnection.call(this, options)
+          }
+
+          var req = request(server).get('/')
+          req.agent(agent)
+          req.expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          req.expect(200, done)
+        })
+      })
     })
 
     describe('when "cookie" is a function', function () {
@@ -888,6 +913,8 @@ describe('session()', function(){
           .expect(200, 'true', done);
       });
     });
+
+
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
         before(function () {