Updated express-session types (#40314)

- Allow `secure: 'auto'` cookie setting
- Restrict `sameSite` cookie setting to boolean or valid string value
  according to (draft) spec

types/express-session/express-session-tests.ts

@@ -7,6 +7,22 @@ app.use(session({
   secret: 'keyboard cat',
   cookie: { secure: true }
 }));
+app.use(session({
+  secret: 'keyboard cat',
+  cookie: { secure: 'auto' }
+}));
+app.use(session({
+  secret: 'keyboard cat',
+  cookie: { sameSite: 'none' }
+}));
+app.use(session({
+  secret: 'keyboard cat',
+  cookie: { sameSite: 'lax' }
+}));
+app.use(session({
+  secret: 'keyboard cat',
+  cookie: { sameSite: 'strict' }
+}));
 app.use(session({
   secret: 'keyboard cat',
   name: 'connect.sid',

types/express-session/index.d.ts

@@ -4,6 +4,7 @@
 //                 Jacob Bogers <https://github.com/jacobbogers>
 //                 Naoto Yokoyama <https://github.com/builtinnya>
 //                 Ryan Cannon <https://github.com/ry7n>
+//                 Tom Spencer <https://github.com/fiznool>
 // Definitions: https://github.com/DefinitelyTyped/DefinitelyTyped
 // TypeScript Version: 2.3
 
@@ -58,7 +59,17 @@ declare namespace session {
     secret: string | string[];
     name?: string;
     store?: Store | MemoryStore;
-    cookie?: express.CookieOptions;
+    cookie?: {
+      maxAge?: number;
+      signed?: boolean;
+      expires?: Date;
+      httpOnly?: boolean;
+      path?: string;
+      domain?: string;
+      secure?: boolean | 'auto';
+      encode?: (val: string) => string;
+      sameSite?: boolean | 'lax' | 'strict' | 'none';
+    };
     genid?(req: express.Request): string;
     rolling?: boolean;
     resave?: boolean;