From f8ba98d9883e2fb11e8521a00d1e9d77b68839e3 Mon Sep 17 00:00:00 2001
From: Simon Tretter <simllll@users.noreply.github.com>
Date: Fri, 26 Feb 2021 09:47:51 +0100
Subject: [PATCH] fix: secure aut and samesite none case

if secure is set to `auto` and sameSite is set to `none` it can result into secure is set to false, and therefore the cookie will not be set.
Because sameSite none always needs a secure context.

This fixes this behaviour, in case secure evaluates to false and sameSite is set explicitly to none, sameSite will be removed.
---
 index.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/index.js b/index.js
index d7efeab9..2cce582e 100644
--- a/index.js
+++ b/index.js
@@ -162,6 +162,11 @@ function session(options) {
 
     if (cookieOptions.secure === 'auto') {
       req.session.cookie.secure = issecure(req, trustProxy);
+      // if sameSite is set to "none", secure is required,
+      // but auto can set secure to false, therefor remove sameSite attribute in this case
+      if (req.session.cookie.sameSite === 'none' && !req.session.cookie.secure) {
+        delete req.session.cookie.sameSite;
+      }
     }
   };