res.cookie does not allow setting Max-Age only, without Expires (One should be able to set maxAge alone, with expires: 0)
- Dominant language
- JavaScript
- Stars
- 69.5k
- Forks
- 25k
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 9
Description
I want to set a cookie with `Max-Age` only, without having `Expires`. But the following lines 875-876 keep adding the unwanted `Expires`:
https://github.com/expressjs/express/blob/0debedf4f31bb20203da0534719b9b10d6ac9a29/lib/response.js#L871-L878
Setting `expires: 0` does no good to override that behavior.
I think one should be allowed to only set Max-Age without automatically having Expires also set.
```
res.cookie('MyCookie', 'TheValue', {
expires: 0, // I don't want any Expires in the resulting Set-Cookie statement
maxAge: 60000,
});
```
### Actual result:
```
MyCookie=TheValue; Max-Age=60; Path=/; Expires=Sun, 26 Mar 2023 06:00:31 GMT
```
### Desired result:
```
MyCookie=TheValue; Max-Age=60; Path=/;
```
### Workaround
The workaround for this is our having to manually write the `Set-Cookie` statement, possibly mimicking the same logic in the express code.
### Possible solution
```
if (opts.expires !== 0) {
opts.expires = new Date(Date.now() + maxAge)
}
```
Contributor guide
Assessment
This issue has not been assessed yet.