CookieJar.setCookie does not slide expiration for set-cookie headers with max-age
See original GitHub issueThe creation time from old-cookie is carried forward per the spec, but this causes the expiryTime() to be unaffected by subsequent set-cookie headers, so the cookie will expire when its creation + max-age > now, even if subsequent set-cookie headers specified max-age with the intent of making the expiration now + max-age.
I’m currently working around this by just having a Store implementation that passes null
to the callback, so that the creation is not carried forward.
Issue Analytics
- State:
- Created 4 years ago
- Comments:11 (4 by maintainers)
Top Results From Across the Web
Is it possible to set the Expires/Max-Age of an existing cookie ...
Is being able to update the value but not the expiration of a cookie through a Set-Cookie header a known/expected behavior? Or is...
Read more >PK00842: COOKIE EXPIRATION THROUGH SET ... - IBM
When trying to expire an existing session cookie, a user is setting the Cookie MaxAge value to 0 seconds. However, when the browser...
Read more >CookieManager - Android Developers
CookieManager represents cookies as strings in the same format as the HTTP Cookie and Set-Cookie header fields (defined in RFC6265bis).
Read more >axios clear cookies | The AI Search Engine You Control
Cookies can be persistent (not destroyed after the browser is closed) with an expiration. Open side panel. Navigate to other page on API...
Read more >@filedescriptor HITCON 2019
Set-Cookie : sid=123; path=/admin ... Expires Max-Age Domain Path SameSite Secure HttpOnly ... The correct way to limit the scope is to not...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
We’ll discuss this in our next meeting of the team; I’ll try my best to look into this before hand. 😃
Thanks for asking about this @byroncoetsee and @ricellis
For anyone landing here, and looking for a simple workaround while this issue gets looked at, here’s what I did. NOTE: Doing it this way will drop things like
creationIndex
etc. It essentially recreates the cookie from scratch - and in doing so, sets thecreationDate
to now.