set sameSite: lax by default (#277)

plugin.js

@@ -11,7 +11,7 @@ const kReplySetCookiesHookRan = Symbol('fastify.reply.setCookiesHookRan')
 function fastifyCookieSetCookie (reply, name, value, options) {
  parseCookies(reply.server, reply.request, reply)
 
- const opts = Object.assign({}, options)
+ const opts = Object.assign({ sameSite: 'lax' }, options)
 
  if (opts.expires && Number.isInteger(opts.expires)) {
  opts.expires = new Date(opts.expires)
@@ -25,7 +25,6 @@ function fastifyCookieSetCookie (reply, name, value, options) {
  if (reply.request.protocol === 'https') {
  opts.secure = true
  } else {
- opts.sameSite = 'lax'
  opts.secure = false
  }
  }
@@ -45,6 +44,7 @@ function fastifyCookieClearCookie (reply, name, options) {
  signed: undefined,
  maxAge: undefined
  })
+
  return fastifyCookieSetCookie(reply, name, '', opts)
 }
 

test/cookie.test.js

@@ -127,8 +127,8 @@ test('should set multiple cookies', (t) => {
  t.equal(cookies[2].name, 'wee')
  t.equal(cookies[2].value, 'woo')
 
- t.equal(res.headers['set-cookie'][1], 'bar=test; Partitioned')
- t.equal(res.headers['set-cookie'][2], 'wee=woo; Secure; Partitioned')
+ t.equal(res.headers['set-cookie'][1], 'bar=test; Partitioned; SameSite=Lax')
+ t.equal(res.headers['set-cookie'][2], 'wee=woo; Secure; Partitioned; SameSite=Lax')
  })
 })
 
@@ -957,7 +957,7 @@ test('result in an error if hook-option is set to an invalid value', (t) => {
  const fastify = Fastify()
 
  t.rejects(
- () => fastify.register(plugin, { hook: true }),
+ async () => fastify.register(plugin, { hook: true }),
  new Error("@fastify/cookie: Invalid value provided for the hook-option. You can set the hook-option only to false, 'onRequest' , 'preParsing' , 'preValidation' or 'preHandler'")
  )
 })