Expire cookie immediately upon destroying session

Fixes #241.

Author: JamesMGreene

Diff for: index.js

@@ -142,11 +142,7 @@ function session(options){
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    req.session.cookie = new Cookie(cookieOptions);
-
-    if (cookieOptions.secure === 'auto') {
-      req.session.cookie.secure = issecure(req, trustProxy);
-    }
+    req.session.cookie = createCookie(cookieOptions, req, trustProxy);
   };
 
   var storeImplementsTouch = typeof store.touch === 'function';
@@ -187,26 +183,46 @@ function session(options){
 
     // set-cookie
     onHeaders(res, function(){
+      // Is this an existing session that is being destroyed?
+      var isBeingDestroyed = !!cookieId && shouldDestroy(req);
+
       if (!req.session) {
         debug('no session');
-        return;
+        if (!isBeingDestroyed) {
+          return;
+        }
       }
 
-      if (!shouldSetCookie(req)) {
-        return;
+      var cookie = req.session ? req.session.cookie : undefined;
+
+      if (isBeingDestroyed) {
+        if (cookie == null) {
+          debug('creating expired cookie');
+          cookie = createCookie(cookieOptions, req, trustProxy);
+        }
+
+        // Set the cookie to immediately expire on the client
+        cookie.maxAge = 0;
       }
 
       // only send secure cookies via https
-      if (req.session.cookie.secure && !issecure(req, trustProxy)) {
+      if (cookie.secure && !issecure(req, trustProxy)) {
         debug('not secured');
         return;
       }
 
-      // touch session
-      req.session.touch();
+      if (!isBeingDestroyed) {
+        if (!shouldSetCookie(req)) {
+          return;
+        }
+        else {
+          // touch session
+          req.session.touch();
+        }
+      }
 
       // set cookie
-      setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data);
+      setcookie(res, name, req.sessionID, secrets[0], cookie.data);
     });
 
     // proxy end() to commit the session
@@ -436,6 +452,25 @@ function session(options){
   };
 };
 
+/**
+ * Create a new Cookie for this request.
+ *
+ * @param {Object} cookieOptions
+ * @param {Object} req
+ * @param {Boolean} [trustProxy]
+ * @return {Cookie}
+ * @private
+ */
+function createCookie(cookieOptions, req, trustProxy) {
+  var cookieOpts = cookieOptions || {};
+
+  var cookie = new Cookie(cookieOpts);
+  if (cookieOpts.secure === 'auto') {
+    cookie.secure = issecure(req, trustProxy);
+  }
+  return cookie;
+}
+
 /**
  * Generate a session ID for a new session.
  *