Skip to content

fix(platform-web): expire a cookie immediately with maxAge: 0 - #248

Merged
dangreen merged 1 commit into
mainfrom
fix/cookie-max-age-zero
Sep 8, 2026
Merged

fix(platform-web): expire a cookie immediately with maxAge: 0#248
dangreen merged 1 commit into
mainfrom
fix/cookie-max-age-zero

Conversation

@dangreen

@dangreen dangreen commented Sep 8, 2026

Copy link
Copy Markdown
Member

Why

CookieStorage.set turned maxAge into expires behind a truthiness check:

expires: maxAge ? Date.now() + maxAge * 1000 : expires

maxAge: 0 means immediate expiration in Set-Cookie terms, but here it read as "not set", so the cookie was written with the expires option instead, usually as a session cookie. The new spec should expire the cookie immediately with zero max age times out on main waiting for the cookie to disappear.

What

  • The check is now maxAge === undefined, so zero expires the cookie right away. maxAge keeps its precedence over expires, as in RFC 6265.
  • Two browser tests against the real Cookie Store: maxAge: 60 lands expires within a minute from now, maxAge: 0 deletes the cookie.
  • One sentence on the Cookies docs page: maxAge is given in seconds and takes precedence over expires.

Size

All publics grows by 3 B gzipped for the undefined comparison, 3419 B against the 3.45 kB limit re-pinned in #247.

Checks

  • oxlint, tsc --noEmit, vitest run (62 tests, browser mode) and size-limit in packages/platform-web pass.

`CookieStorage.set` tested `maxAge` for truthiness before turning it into `expires`, so `maxAge: 0`, which means immediate expiration in `Set-Cookie` terms, was silently dropped and the cookie was written with the `expires` option instead, usually as a session cookie. The check is now against `undefined`, and `maxAge` keeps its precedence over `expires`. The docs state that `maxAge` is given in seconds.
@codecov

codecov Bot commented Sep 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.33%. Comparing base (2696386) to head (9b83d02).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #248      +/-   ##
==========================================
+ Coverage   83.29%   83.33%   +0.03%     
==========================================
  Files          98       98              
  Lines        2556     2556              
  Branches      551      551              
==========================================
+ Hits         2129     2130       +1     
  Misses        314      314              
+ Partials      113      112       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@dangreen
dangreen merged commit bae248e into main Sep 8, 2026
10 checks passed
@dangreen
dangreen deleted the fix/cookie-max-age-zero branch September 8, 2026 16:16
@github-actions github-actions Bot mentioned this pull request Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant