From 9c0a599b72e4695278f348ed4d0bcba121339b34 Mon Sep 17 00:00:00 2001
From: Hashim Khan <sardarhashim30@gmail.com>
Date: Mon, 27 Jul 2026 04:01:48 +0500
Subject: [PATCH 1/2] fix(types): document cookie secure/httpOnly defaults as
 true

Align CookieOptions JSDoc with runtime and README defaults so editors
no longer inherit @fastify/cookie false defaults.

Fixes #299
---
 types/index.d.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/types/index.d.ts b/types/index.d.ts
index 35729f0..043909e 100644
--- a/types/index.d.ts
+++ b/types/index.d.ts
@@ -180,9 +180,20 @@ declare namespace fastifySession {
     cookiePrefix?: string;
   }
 
-  export interface CookieOptions extends Omit<CookieSerializeOptions, 'signed' | 'maxAge'> {
+  export interface CookieOptions extends Omit<CookieSerializeOptions, 'signed' | 'maxAge' | 'httpOnly' | 'secure'> {
     /** A `number` in milliseconds that specifies the `Expires` attribute by adding the specified milliseconds to the current date. If both `expires` and `maxAge` are set, then `expires` is used. */
     maxAge?: number;
+    /**
+     * The `boolean` value of the `HttpOnly` attribute.
+     * @default true
+     */
+    httpOnly?: boolean;
+    /**
+     * The `boolean` value of the `Secure` attribute. Set this option to false when communicating over an unencrypted (HTTP) connection.
+     * Value can be set to `auto`; in that case the `Secure` attribute is false for HTTP and true for HTTPS.
+     * @default true
+     */
+    secure?: boolean | 'auto';
   }
 
   export class MemoryStore implements fastifySession.SessionStore {

From 9a0df3ea106e17aeb432ecc25d423dd35827bff9 Mon Sep 17 00:00:00 2001
From: Hashim1999164 <Hashim1999164@users.noreply.github.com>
Date: Mon, 27 Jul 2026 20:54:52 +0500
Subject: [PATCH 2/2] test(types): assert CookieOptions httpOnly and secure
 defaults

---
 types/index.tst.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/types/index.tst.ts b/types/index.tst.ts
index 8312765..920d42a 100644
--- a/types/index.tst.ts
+++ b/types/index.tst.ts
@@ -56,9 +56,11 @@ app.register(plugin, {
   }
 })
 
-const cookieMaxAge: CookieOptions = {}
+const cookieOptions: CookieOptions = {}
 
-expect(cookieMaxAge.maxAge).type.toBe<number | undefined>()
+expect(cookieOptions.maxAge).type.toBe<number | undefined>()
+expect(cookieOptions.httpOnly).type.toBe<boolean | undefined>()
+expect(cookieOptions.secure).type.toBe<boolean | 'auto' | undefined>()
 
 app.register(plugin, {
   secret,