feat(core): FastSetCookie accepts variadic func(*http.Cookie) opts

Callers can now adjust the cookie before it's written without falling
back to the longer SetCookie signature:

    c.FastSetCookie("session", "v", 3600, func(ck *http.Cookie) {
        ck.Secure = true
        ck.SameSite = http.SameSiteStrictMode
    })

Defaults (path=/, httpOnly=true, secure=false) are preserved, so all
existing FastSetCookie calls keep working unchanged. Implementation
now constructs the http.Cookie directly and applies opts in order,
letting any field be overridden including Path / MaxAge / Domain.

Tests cover both the no-opts default and the multi-opt override path.
Both READMEs show the HTTPS Secure + SameSite snippet.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: inhere

README.md

@@ -357,6 +357,15 @@ r.GET("/setcookie", func(c *rux.Context) {
 	c.WriteString("hello, in " + c.URL().Path)
 })
 
+// FastSetCookie accepts optional func(*http.Cookie) callbacks to override
+// the developer-friendly defaults — handy for HTTPS / SameSite.
+r.GET("/setsecure", func(c *rux.Context) {
+    c.FastSetCookie("session", "v", 3600, func(ck *http.Cookie) {
+        ck.Secure = true
+        ck.SameSite = http.SameSiteStrictMode
+    })
+})
+
 r.GET("/delcookie", func(c *rux.Context) {
 	val := ctx.Cookie("rux_cookie") // "test-value1"
 	c.DelCookie("rux_cookie", "rux_cookie2")

README.zh-CN.md

@@ -310,6 +310,15 @@ r.GET("/setcookie", func(c *rux.Context) {
 	c.WriteString("hello, in " + c.URL().Path)
 })
 
+// FastSetCookie 接收可选的 func(*http.Cookie) 回调，用来覆盖默认设置
+// （比如 HTTPS 场景需要的 Secure / SameSite）
+r.GET("/setsecure", func(c *rux.Context) {
+    c.FastSetCookie("session", "v", 3600, func(ck *http.Cookie) {
+        ck.Secure = true
+        ck.SameSite = http.SameSiteStrictMode
+    })
+})
+
 r.GET("/delcookie", func(c *rux.Context) {
 	val := ctx.Cookie("rux_cookie") // "test-value1"
 	c.DelCookie("rux_cookie", "rux_cookie2")

internal/core/context.go

@@ -264,14 +264,29 @@ func (c *Context) SetCookie(name, value string, maxAge int, path, domain string,
 }
 
 // FastSetCookie sets a response cookie with developer-friendly defaults:
-// path=/, httpOnly=true, secure=false. The Secure attribute is deliberately
-// off so cookies work over plain HTTP during local development.
+// path=/, httpOnly=true, secure=false. Optional opts run after the cookie
+// is built and let you flip Secure, set SameSite, override Path, etc.
 //
-// SECURITY: for production HTTPS deployments use SetCookie directly with
-// secure=true (and consider SameSite via http.SetCookie if you need it).
-// This default is preserved for backward compatibility.
-func (c *Context) FastSetCookie(name, value string, maxAge int) {
-	c.SetCookie(name, value, maxAge, "/", "", false, true)
+//	c.FastSetCookie("session", "v", 3600)
+//	c.FastSetCookie("session", "v", 3600, func(ck *http.Cookie) {
+//	    ck.Secure = true
+//	    ck.SameSite = http.SameSiteStrictMode
+//	})
+//
+// The defaults are kept for backward compatibility; HTTPS callers should
+// flip Secure via opts (or use SetCookie directly).
+func (c *Context) FastSetCookie(name, value string, maxAge int, opts ...func(*http.Cookie)) {
+	ck := &http.Cookie{
+		Name:     name,
+		Value:    value,
+		MaxAge:   maxAge,
+		Path:     "/",
+		HttpOnly: true,
+	}
+	for _, opt := range opts {
+		opt(ck)
+	}
+	http.SetCookie(c.Resp, ck)
 }
 
 // DelCookie deletes one or more cookies by setting MaxAge=-1.

internal/core/context_test.go

@@ -58,6 +58,28 @@ func TestContext_FastSetCookie(t *testing.T) {
 	assert.True(t, strings.Contains(setCookie, "token=xyz"))
 	assert.True(t, strings.Contains(setCookie, "Path=/"))
 	assert.True(t, strings.Contains(setCookie, "HttpOnly"))
+	// Secure off by default — see FastSetCookie godoc.
+	assert.False(t, strings.Contains(setCookie, "Secure"))
+}
+
+func TestContext_FastSetCookie_WithOpts(t *testing.T) {
+	c := &Context{}
+	w := httptest.NewRecorder()
+	c.Init(w, httptest.NewRequest("GET", "/x", nil))
+	c.FastSetCookie("session", "v", 3600,
+		func(ck *http.Cookie) { ck.Secure = true },
+		func(ck *http.Cookie) { ck.SameSite = http.SameSiteStrictMode },
+		func(ck *http.Cookie) { ck.Domain = "example.com" },
+	)
+
+	setCookie := w.Header().Get("Set-Cookie")
+	assert.True(t, strings.Contains(setCookie, "session=v"))
+	assert.True(t, strings.Contains(setCookie, "Secure"))
+	assert.True(t, strings.Contains(setCookie, "SameSite=Strict"))
+	assert.True(t, strings.Contains(setCookie, "Domain=example.com"))
+	// Defaults still preserved unless an opt overrode them.
+	assert.True(t, strings.Contains(setCookie, "Path=/"))
+	assert.True(t, strings.Contains(setCookie, "HttpOnly"))
 }
 
 func TestContext_DelCookie(t *testing.T) {