Set http.Cookie's SameSite field in NewCookie for Go 1.11 or later

cookie.go

@@ -0,0 +1,19 @@
+// +build !go1.11
+
+package sessions
+
+import "net/http"
+
+// newCookieFromOptions returns an http.Cookie with the options set.
+func newCookieFromOptions(name, value string, options *Options) *http.Cookie {
+	return &http.Cookie{
+		Name:     name,
+		Value:    value,
+		Path:     options.Path,
+		Domain:   options.Domain,
+		MaxAge:   options.MaxAge,
+		Secure:   options.Secure,
+		HttpOnly: options.HttpOnly,
+	}
+
+}

cookie_go111.go

@@ -0,0 +1,20 @@
+// +build go1.11
+
+package sessions
+
+import "net/http"
+
+// newCookieFromOptions returns an http.Cookie with the options set.
+func newCookieFromOptions(name, value string, options *Options) *http.Cookie {
+	return &http.Cookie{
+		Name:     name,
+		Value:    value,
+		Path:     options.Path,
+		Domain:   options.Domain,
+		MaxAge:   options.MaxAge,
+		Secure:   options.Secure,
+		HttpOnly: options.HttpOnly,
+		SameSite: options.SameSite,
+	}
+
+}

cookie_go111_test.go

@@ -0,0 +1,29 @@
+// +build go1.11
+
+package sessions
+
+import (
+	"net/http"
+	"testing"
+)
+
+// Test for setting SameSite field in new http.Cookie from name, value
+// and options
+func TestNewCookieFromOptionsSameSite(t *testing.T) {
+	tests := []struct {
+		sameSite http.SameSite
+	}{
+		{http.SameSiteDefaultMode},
+		{http.SameSiteLaxMode},
+		{http.SameSiteStrictMode},
+	}
+	for i, v := range tests {
+		options := &Options{
+			SameSite: v.sameSite,
+		}
+		cookie := newCookieFromOptions("", "", options)
+		if cookie.SameSite != v.sameSite {
+			t.Fatalf("%v: bad cookie sameSite: got %v, want %v", i+1, cookie.SameSite, v.sameSite)
+		}
+	}
+}

cookie_test.go

@@ -0,0 +1,57 @@
+package sessions
+
+import (
+	"testing"
+)
+
+// Test for creating new http.Cookie from name, value and options
+func TestNewCookieFromOptions(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    string
+		path     string
+		domain   string
+		maxAge   int
+		secure   bool
+		httpOnly bool
+	}{
+		{"", "bar", "/foo/bar", "foo.example.com", 3600, true, true},
+		{"foo", "", "/foo/bar", "foo.example.com", 3600, true, true},
+		{"foo", "bar", "", "foo.example.com", 3600, true, true},
+		{"foo", "bar", "/foo/bar", "", 3600, true, true},
+		{"foo", "bar", "/foo/bar", "foo.example.com", 0, true, true},
+		{"foo", "bar", "/foo/bar", "foo.example.com", 3600, false, true},
+		{"foo", "bar", "/foo/bar", "foo.example.com", 3600, true, false},
+	}
+	for i, v := range tests {
+		options := &Options{
+			Path:     v.path,
+			Domain:   v.domain,
+			MaxAge:   v.maxAge,
+			Secure:   v.secure,
+			HttpOnly: v.httpOnly,
+		}
+		cookie := newCookieFromOptions(v.name, v.value, options)
+		if cookie.Name != v.name {
+			t.Fatalf("%v: bad cookie name: got %q, want %q", i+1, cookie.Name, v.name)
+		}
+		if cookie.Value != v.value {
+			t.Fatalf("%v: bad cookie value: got %q, want %q", i+1, cookie.Value, v.value)
+		}
+		if cookie.Path != v.path {
+			t.Fatalf("%v: bad cookie path: got %q, want %q", i+1, cookie.Path, v.path)
+		}
+		if cookie.Domain != v.domain {
+			t.Fatalf("%v: bad cookie domain: got %q, want %q", i+1, cookie.Domain, v.domain)
+		}
+		if cookie.MaxAge != v.maxAge {
+			t.Fatalf("%v: bad cookie maxAge: got %q, want %q", i+1, cookie.MaxAge, v.maxAge)
+		}
+		if cookie.Secure != v.secure {
+			t.Fatalf("%v: bad cookie secure: got %v, want %v", i+1, cookie.Secure, v.secure)
+		}
+		if cookie.HttpOnly != v.httpOnly {
+			t.Fatalf("%v: bad cookie httpOnly: got %v, want %v", i+1, cookie.HttpOnly, v.httpOnly)
+		}
+	}
+}

sessions.go

@@ -178,15 +178,7 @@ func Save(r *http.Request, w http.ResponseWriter) error {
 // the Expires field calculated based on the MaxAge value, for Internet
 // Explorer compatibility.
 func NewCookie(name, value string, options *Options) *http.Cookie {
-	cookie := &http.Cookie{
-		Name:     name,
-		Value:    value,
-		Path:     options.Path,
-		Domain:   options.Domain,
-		MaxAge:   options.MaxAge,
-		Secure:   options.Secure,
-		HttpOnly: options.HttpOnly,
-	}
+	cookie := newCookieFromOptions(name, value, options)
 	if options.MaxAge > 0 {
 		d := time.Duration(options.MaxAge) * time.Second
 		cookie.Expires = time.Now().Add(d)