expressjs / expressjs/session

Set-Cookie is not updated after changing `cookie` config even when `rolling` is set to true

Open
#1,077 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
6.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

## Environment information

**Version**: 1.18.2

**Platform**: All

**Node.js version**: v22.17.1

**Any other relevant information**: -

## What steps will reproduce the bug?

Config I'm using:

```js
app.use(expressSession({
secret: '...',
name: "sessionId",
store: new (require('connect-pg-simple')(expressSession))(),
cookie: {
httpOnly: true,
secure: true,
domain: "example.com",
sameSite: "none",
maxAge: 7 * 24 * 60 * 60 * 1000 // 7 days
},
proxy: true,
resave: false,
saveUninitialized: false,
rolling: true,
}));
```

If I change e.g. `sameSite` to "strict", or change `maxAge`, this only applies to brand new sessions. I would expect that with `rolling: true`, these changes would apply to existing cookies too when the user next time uses the app.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.