question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CookieJar.setCookie does not slide expiration for set-cookie headers with max-age

See original GitHub issue

The creation time from old-cookie is carried forward per the spec, but this causes the expiryTime() to be unaffected by subsequent set-cookie headers, so the cookie will expire when its creation + max-age > now, even if subsequent set-cookie headers specified max-age with the intent of making the expiration now + max-age.

I’m currently working around this by just having a Store implementation that passes null to the callback, so that the creation is not carried forward.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:11 (4 by maintainers)

github_iconTop GitHub Comments

3reactions
awatermacommented, Jun 23, 2022

We’ll discuss this in our next meeting of the team; I’ll try my best to look into this before hand. 😃

Thanks for asking about this @byroncoetsee and @ricellis

0reactions
byroncoetseecommented, Jun 28, 2022

For anyone landing here, and looking for a simple workaround while this issue gets looked at, here’s what I did. NOTE: Doing it this way will drop things like creationIndex etc. It essentially recreates the cookie from scratch - and in doing so, sets the creationDate to now.

class CustomMemoryCookieStore extends MemoryCookieStore {
    updateCookie(oldCookie: Cookie, newCookie: Cookie, cb: (err: Error | null) => void): void
    updateCookie(oldCookie: Cookie, newCookie: Cookie): Promise<void>;
    updateCookie(_: any, newCookie: any, cb?: any): void | Promise<void> {
        newCookie.creation = new Date()
        this.putCookie(newCookie, cb)
        if (cb == null) {
            return Promise.resolve()
        }
    }
}
Read more comments on GitHub >

github_iconTop Results From Across the Web

Is it possible to set the Expires/Max-Age of an existing cookie ...
Is being able to update the value but not the expiration of a cookie through a Set-Cookie header a known/expected behavior? Or is...
Read more >
PK00842: COOKIE EXPIRATION THROUGH SET ... - IBM
When trying to expire an existing session cookie, a user is setting the Cookie MaxAge value to 0 seconds. However, when the browser...
Read more >
CookieManager - Android Developers
CookieManager represents cookies as strings in the same format as the HTTP Cookie and Set-Cookie header fields (defined in RFC6265bis).
Read more >
axios clear cookies | The AI Search Engine You Control
Cookies can be persistent (not destroyed after the browser is closed) with an expiration. Open side panel. Navigate to other page on API...
Read more >
@filedescriptor HITCON 2019
Set-Cookie : sid=123; path=/admin ... Expires Max-Age Domain Path SameSite Secure HttpOnly ... The correct way to limit the scope is to not...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found