1 file changed, 11 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index a45b1e98..974544df 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -353,6 +353,17 @@ h.contains("an insecure session cookie keeps its plain name", out, "Set-Cookie:
 h.excludes("and is not marked Secure", out, "; Secure")
 load_script()
 
+-- A cookie carries whole seconds, while on Lua 5.3 and later a session length
+-- worked out with a fraction is a float, which tostring writes with a ".0".
+load_script({ { "local session_seconds = 7 * 24 * 60 * 60",
+	"local session_seconds = 1.5 * 24 * 60 * 60" } })
+out = login("Alice", password, way_back)
+granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);")
+h.equals("a session a day and a half long still verifies",
+	granted and validate_value("username", granted, account_hash), "Alice")
+h.contains("and its cookie lasts as many whole seconds", out, "; Max-Age=129600\n")
+load_script()
+
 -- The libraries load only once a request needs one, so with every one of
 -- them gone a public repository is still served, while a protected one
 -- fails closed instead of reaching its content.