Add :set-cookies? option to wrap-session

Fixes #456. Closes #392.

Author: weavejester

ring-core/src/ring/middleware/session.clj

@@ -14,6 +14,7 @@
 (defn- session-options
   [options]
   {:store        (options :store (mem/memory-store))
+   :set-cookies? (options :set-cookies? true)
    :cookie-name  (options :cookie-name "ring-session")
    :cookie-attrs (merge {:path "/"
                          :http-only true}
@@ -72,7 +73,7 @@
    (if response
      (-> response
          (bare-session-response request options)
-         cookies/cookies-response))))
+         (cond-> (:set-cookies? options true) cookies/cookies-response)))))
 
 (defn wrap-session
   "Reads in the current HTTP session map, and adds it to the :session key on
@@ -97,7 +98,10 @@
   :cookie-attrs - A map of attributes to associate with the session cookie.
                   Defaults to {:http-only true}. This may be overridden on a
                   per-response basis by adding :session-cookie-attrs to the
-                  response."
+                  response.
+
+  :set-cookies? - If true, automatically include cookie middleware. Defaults to
+                  true for backward compatibility."
   ([handler]
      (wrap-session handler {}))
   ([handler options]

ring-core/test/ring/middleware/test/session.clj

@@ -77,6 +77,16 @@
         response (handler {:cookies {}})]
     (is (get-session-cookie response))))
 
+(deftest session-set-cookies
+  (testing ":set-cookies? is false"
+    (let [store (make-store (constantly {})
+                            (constantly "foo:bar")
+                            (constantly nil))
+          handler (constantly {:session {:foo "bar"}})
+          handler (wrap-session handler {:store store, :set-cookies? false})
+          response (handler {:cookies {}})]
+      (is (nil? (get-cookies response))))))
+
 (deftest session-delete-outputs-cookie
   (let [store (make-store (constantly {:foo "bar"})
                           (constantly nil)