session: Cookie expiration date not being set correctly

I originally opened this issue in the connect-redis repo (https://github.com/tj/connect-redis/issues/292), and it was suggested the issue be raised upstream to express-session.

When rolling and resave are set to false, and when the session is modified, the Expires date on the Set-Cookie header is set to the current date + maxAge, which causes the age of the session cookie to live beyond the life of the original session (as determined by maxAge).

In other words, when rolling is disabled, the life of the cookie is being extended by maxAge each time the session data changes. The expected behavior (I believe) is that, even when the session data is modified, the session length should never exceed maxAge from the time the session was first created.

This is causing connect-redis to break because the cookie set by express-session is living beyond the length of the maxAge of the original session.

This is happening with the latest version of express-session and connect-redis, Node 10.16.0. Please see https://github.com/tj/connect-redis/issues/292 for a information / discussion of the issue. Sample code showing our configuration when the issue happens:

const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const redis = require('redis');
const redisClient = redis.createClient(...);
const store = new RedisStore({ client: redisClient });

app.use(
  session({
      secret: 'secret here',
      store: store,
      resave: false,
      rolling: false,
      saveUninitialized: false,
      proxy: true,
      name: 'xyz',
      cookie: {
        maxAge: 1000 * 60 * 60 * 24 * 14,
        path: '/',
        secure: true,
        httpOnly: true,
      },
    });
);