From 3940fd7fa3c0d5a091dd41eb85ff2454b42cdb52 Mon Sep 17 00:00:00 2001
From: Segev Finer <segev208@gmail.com>
Date: Thu, 7 Aug 2025 17:35:20 +0300
Subject: [PATCH 1/3] localhost is also a secure origin by browsers

Also partitioned cookies are only allowed with secure, so in `secure: 'auto'` also set partitioned to false
---
 index.js      | 2 +-
 lib/cookie.js | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/index.js b/index.js
index 0879818..03d64fc 100644
--- a/index.js
+++ b/index.js
@@ -160,7 +160,7 @@ function fastifySession (fastify, options, next) {
 
       const cookieSessionId = getCookieSessionId(request)
       const saveSession = shouldSaveSession(request, cookieSessionId, saveUninitializedSession, rollingSessions)
-      const isInsecureConnection = session.cookie.secure === true && request.protocol !== 'https'
+      const isInsecureConnection = session.cookie.secure === true && request.protocol !== 'https' && request.hostname !== 'localhost'
       const sessionIdWithPrefix = hasCookiePrefix ? `${cookiePrefix}${session.encryptedSessionId}` : session.encryptedSessionId
       if (!saveSession || isInsecureConnection) {
         // if a session cookie is set, but has a different ID, clear it
diff --git a/lib/cookie.js b/lib/cookie.js
index 8a58845..3234305 100644
--- a/lib/cookie.js
+++ b/lib/cookie.js
@@ -25,10 +25,11 @@ module.exports = class Cookie {
     }
 
     if (this.secure === 'auto') {
-      if (request.protocol === 'https') {
+      if (request.protocol === 'https' || request.hostname === 'localhost') {
         this.secure = true
       } else {
         this.sameSite = 'lax'
+        this.partitioned = false
         this.secure = false
       }
     }

From 6e4cc1f016f3b619f8f16d775007cc8058a994dc Mon Sep 17 00:00:00 2001
From: Segev Finer <segev@swimm.io>
Date: Tue, 2 Dec 2025 11:15:49 +0200
Subject: [PATCH 2/3] Try to fix tests

---
 test/cookie.test.js  | 2 ++
 test/session.test.js | 1 +
 test/util.js         | 2 +-
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/test/cookie.test.js b/test/cookie.test.js
index e0ad1bf..2a05edd 100644
--- a/test/cookie.test.js
+++ b/test/cookie.test.js
@@ -361,6 +361,7 @@ test('should set session cookie secureAuto', async (t) => {
   t.after(() => { fastify.close() })
 
   const response = await fastify.inject({
+    authority: 'fastify-session.test',
     url: '/'
   })
 
@@ -388,6 +389,7 @@ test('should set session cookie secureAuto change SameSite', async (t) => {
   t.after(() => { fastify.close() })
 
   const response = await fastify.inject({
+    authority: 'fastify-session.test',
     url: '/'
   })
 
diff --git a/test/session.test.js b/test/session.test.js
index f93cdfa..ccec6e2 100644
--- a/test/session.test.js
+++ b/test/session.test.js
@@ -1365,6 +1365,7 @@ test('Override global options with regenerate', async t => {
   fastify.register(fastifyCookie)
   fastify.register(fastifySession, {
     ...DEFAULT_OPTIONS,
+    saveUninitialized: true,
     cookie: {
       secure: false,
       maxAge: 42,
diff --git a/test/util.js b/test/util.js
index f11c033..83f8d73 100644
--- a/test/util.js
+++ b/test/util.js
@@ -6,7 +6,7 @@ const fastifySession = require('..')
 const TestStore = require('./TestStore')
 
 const DEFAULT_SECRET = 'cNaoPYAwF60HZJzkcNaoPYAwF60HZJzk'
-const DEFAULT_OPTIONS = { secret: DEFAULT_SECRET }
+const DEFAULT_OPTIONS = { secret: DEFAULT_SECRET, saveUninitialized: false }
 const DEFAULT_SESSION_ID = 'Qk_XT2K7-clT-x1tVvoY6tIQ83iP72KN'
 const DEFAULT_ENCRYPTED_SESSION_ID = `${DEFAULT_SESSION_ID}.B7fUDYXU9fXF9pNuL3qm4NVmSduLJ6kzCOPh5JhHGoE`
 const DEFAULT_COOKIE_VALUE = `sessionId=${DEFAULT_ENCRYPTED_SESSION_ID};`

From 2843cf4fdb7f3b02eb3dd2d9f242f57a6052aa0b Mon Sep 17 00:00:00 2001
From: Segev Finer <segev@swimm.io>
Date: Tue, 1 Sep 2026 13:48:14 +0300
Subject: [PATCH 3/3] Fix failing test

---
 test/cookie.test.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/cookie.test.js b/test/cookie.test.js
index 2a05edd..2e65efa 100644
--- a/test/cookie.test.js
+++ b/test/cookie.test.js
@@ -314,6 +314,7 @@ test('should use session cookie secure override when saving secure cookie', asyn
   t.after(() => { fastify.close() })
 
   const response = await fastify.inject({
+    authority: 'fastify-session.test',
     url: '/'
   })