expressjs / expressjs/express

res.cookie does not allow setting Max-Age only, without Expires (One should be able to set maxAge alone, with expires: 0)

Open
#5,150 4 comments 0 reactions 0 assignees View on GitHub
discuss enhancement
Dominant language
JavaScript
Stars
69.5k
Forks
25k
Avg merge
4d 20h
Merged PRs (30d)
9

Description

I want to set a cookie with `Max-Age` only, without having `Expires`. But the following lines 875-876 keep adding the unwanted `Expires`:

https://github.com/expressjs/express/blob/0debedf4f31bb20203da0534719b9b10d6ac9a29/lib/response.js#L871-L878

Setting `expires: 0` does no good to override that behavior.

I think one should be allowed to only set Max-Age without automatically having Expires also set.

```
res.cookie('MyCookie', 'TheValue', {
expires: 0, // I don't want any Expires in the resulting Set-Cookie statement
maxAge: 60000,
});
```

### Actual result:

```
MyCookie=TheValue; Max-Age=60; Path=/; Expires=Sun, 26 Mar 2023 06:00:31 GMT
```

### Desired result:

```
MyCookie=TheValue; Max-Age=60; Path=/;
```

### Workaround

The workaround for this is our having to manually write the `Set-Cookie` statement, possibly mimicking the same logic in the express code.

### Possible solution

```
if (opts.expires !== 0) {
opts.expires = new Date(Date.now() + maxAge)
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.