Why `Max-Age` cookie attribute is not used instead of a hairy `Expires` attribute

To my surprise, I failed to find existing issue on that, so I keep wondering why Max-Age cookie attribute is not used instead of Expires as defined by RFC6265?

I use a recommended cookie.maxAge option in my project, but still the cookie I see in unit tests has Expires: <date>.

I believe Max-Age was invented to solve an obvious issue with (historically older) Expires attribute: that is, dates on server and client generally don’t match due to time zones. So, it is impossible to control on server how exactly client will interpret the date sent.

Also please expire asap command from server seems easier to do with Max-Age=-1 (or any value, <=0, per spec) than with Expires: Thu 02 Feb 1970 12:34:3 (can you say that latter is correct at all?).

The only drawback I found is that IE 6/7/8 do not support it. But most of us don’t care anymore, right? For those who cares Expires can be send, additionally (unlocked by a settings flag?).

[Pavek]

@dougwilson, thanks for reply.

To contribute to this discussion, I found this pretty decent cookie compat table: https://inikulin.github.io/cookie-compat/ The situation in general is pretty bad – who knew Cookie is such a nut… 😃

One particular test case confirms that no recent IE/Edge versions support "foo=bar; max-age=-1" for cookie expiry.

[dougwilson]

Thanks for that information, @Pavek , very helpful 😃