From 850122ad7d6524c4b68dcc891350de079c8740dc Mon Sep 17 00:00:00 2001
From: lprnmns <manasalperen@gmail.com>
Date: Mon, 31 Aug 2026 12:37:46 +0300
Subject: [PATCH] fix: preserve session cookie priority

Signed-off-by: lprnmns <manasalperen@gmail.com>
---
 lib/cookie.js       |  4 +++-
 test/cookie.test.js | 21 +++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/lib/cookie.js b/lib/cookie.js
index 8a58845..cede86b 100644
--- a/lib/cookie.js
+++ b/lib/cookie.js
@@ -9,6 +9,7 @@ module.exports = class Cookie {
     this.domain = cookie.domain || null
     this.httpOnly = cookie.httpOnly !== undefined ? cookie.httpOnly : true
     this.partitioned = cookie.partitioned
+    this.priority = cookie.priority
     this._expires = null
 
     if (cookie.expires) {
@@ -66,7 +67,8 @@ module.exports = class Cookie {
       path: this.path,
       httpOnly: this.httpOnly,
       domain: this.domain,
-      partitioned: this.partitioned
+      partitioned: this.partitioned,
+      priority: this.priority
     }
   }
 }
diff --git a/test/cookie.test.js b/test/cookie.test.js
index e0ad1bf..6152217 100644
--- a/test/cookie.test.js
+++ b/test/cookie.test.js
@@ -499,6 +499,27 @@ test('should set session partitioned cookie secure http encrypted', async (t) =>
   t.assert.strictEqual(new RegExp(pattern).test(response.headers['set-cookie']), true)
 })
 
+test('should set session cookie with priority', async (t) => {
+  t.plan(2)
+  const options = {
+    secret: DEFAULT_SECRET,
+    cookie: { priority: 'high', secure: false }
+  }
+  const fastify = await buildFastify((request, reply) => {
+    request.session.test = {}
+    reply.send(200)
+  }, options)
+  t.after(() => { fastify.close() })
+
+  const response = await fastify.inject({
+    url: '/'
+  })
+
+  t.assert.strictEqual(response.statusCode, 200)
+  const pattern = String.raw`sessionId=${SIGNED_COOKIE_VALUE_PATTERN}; Path=\/; HttpOnly; Priority=High`
+  t.assert.strictEqual(new RegExp(pattern).test(response.headers['set-cookie']), true)
+})
+
 test('should use maxAge instead of expires in session if both are set in options.cookie', async (t) => {
   t.plan(3)
   const expires = new Date(34214461000) // 1971-02-01T00:01:01.000Z