Add sameSite 'auto' support to match secure 'auto' pattern

[djunehor]

This PR adds support for sameSite: 'auto' option that automatically sets the SameSite cookie attribute based on connection security, similar to the existing secure: 'auto' feature.

When the connection is secure (HTTPS), SameSite is set to 'None' to enable cross-site usage, and when insecure (HTTP), it's set to 'Lax' for better security. This solves real-world scenarios like SAML authentication where the connection security isn't known at configuration time.

The implementation follows the same pattern as secure: 'auto', uses the existing issecure() function, and includes comprehensive test coverage with no breaking changes.

Fixes #1081

[bjohansebas]

LGTM. Overall, adding that option looks good to me, I think this would be good to have for v1.

By the way, I added more tests to better verify its behavior with different configurations

[bjohansebas]

The behavior here is interesting and cannot be changed since it would be a breaking change. However, because secure is set to true in the configuration, during cookie creation, which happens on this line

session/index.js

Line 161 in 2cd6561

req.session.cookie = new Cookie(cookieOptions);

takes the value from the configuration rather than from the route. As a result, the cookie ends up being a secure cookie. Since it is a secure cookie, it will not be created when the request is insecure (HTTP)

session/index.js

Line 235 in 2cd6561

if (req.session.cookie.secure && !issecure(req, trustProxy)) {

.

[rmcsharry]

Why call the function twice when once will do?

Suggested change

	if (cookieOptions.secure === 'auto') {
	req.session.cookie.secure = issecure(req, trustProxy);
	}
	if (cookieOptions.sameSite === 'auto') {
	req.session.cookie.sameSite = issecure(req, trustProxy) ? 'none' : 'lax';
	}
	const isSecure = issecure(req, trustProxy);
	if (cookieOptions.secure === 'auto') {
	req.session.cookie.secure = isSecure;
	}
	if (cookieOptions.sameSite === 'auto') {
	req.session.cookie.sameSite = isSecure ? 'none' : 'lax';
	}

[djunehor]

I initially implemented each check independently without considering that both checks rely on the same issecure() call.

I've updated the code to cache the result in a const isSecure variable and reuse it for both the secure and sameSite auto configurations. This avoids the redundant function call you pointed out.

Thanks for the review!