Additional allowed cookieOptions

[joshcanhelp]

Description

• Adds an ephemeral flag to appSessionCookie that, when true, will set the expire attribute for the session cookie to 0. Default value is false, which will use the appSessionDuration to set the cookie expiration.
• Changes the default sameSite value in appSessionCookie to Lax. This does not change the behavior of the nonce or state cookies.

From the documentation:

Object defining application session cookie attributes. Allowed keys are domain, ephemeral, httpOnly, path, secure, and sameSite. Defaults are true for httpOnly, Lax for sameSite, and false for ephemeral. See the Express Response documentation for more information on all properties except ephemeral.

References

• https://expressjs.com/en/api.html#res.cookie
• https://github.com/joshcanhelp/express-openid-connect/pull/1

Testing

• This change adds test coverage for new/changed/fixed functionality

[panva]

Giving developers the option to set expires sounds like they should be configuring it, when in fact you'd only wanna use it to set it to 0 to get ephemeral cookies.

So why not call it ephemeral: true in the first place?

I don't think I'd ever have a case where I want use maxAge or expires, because for duration, i have the duration configuration option and i always figure they should be aligned (cookie and the JWE expiration).

Please get rid of maxAge as well as expires, and just have one boolean to get the removed feature in 08e6702