jetty / jetty/jetty.project

Reparsing cookie loses Max-Age/Expire attributes

Open
#15,802 2 comments 0 reactions 0 assignees View on GitHub
Bug
Dominant language
Java
Stars
4.1k
Forks
2k
Avg merge
3d 56m
Merged PRs (30d)
48

Description

**Jetty version(s)**
12.1.13

**Jetty Environment**
e11

**HTTP version**
1

**Java version/vendor** `(use: java -version)`
openjdk version "25.0.1" 2025-10-21 LTS
OpenJDK Runtime Environment Temurin-25.0.1+8 (build 25.0.1+8-LTS)
OpenJDK 64-Bit Server VM Temurin-25.0.1+8 (build 25.0.1+8-LTS, mixed mode, sharing)

**OS type/version**
Ubuntu 24

**Description**
This comes from my initial report in spring-boot where the cause was reduced to jetty specifics rather than spring-boot (https://github.com/spring-projects/spring-boot/issues/51770#issuecomment-5682450799) , thus I'm filing the report here as well:

When a cookie created with Max-Age 0 is turned into a String it only get's an Expires attribute, and when it's parsed back into a cookie it looses the Max-Age as well as the Expires attributes.

**How to reproduce?**

```java
HttpCookie builtCookie = HttpCookie.build("biscuit", "").maxAge(0).build();
String builtCookieHeader = HttpCookieUtils.getRFC6265SetCookie(builtCookie);
System.out.println(builtCookieHeader);
HttpCookie parsedCookie = SetCookieParser.newInstance().parse(builtCookieHeader);
System.out.println(HttpCookieUtils.getRFC6265SetCookie(parsedCookie));
```
The above produces the following output:
```
biscuit=; Expires=Thu, 01 Jan 1970 00:00:00 GMT
biscuit=
```
The expected outcome would be to also include the Max-Age when creating the raw cookie string, as well as to maintain the MaxAge in the parsed cookie. The above turns the cookie into a session cookie rather than removing it.

This might be related to https://github.com/jetty/jetty.project/issues/15760

Contributor guide

Open the contributing guide

Research direction

Start with HttpCookie.build, HttpCookieUtils.getRFC6265SetCookie, and SetCookieParser.newInstance().parse using the reproduction in the issue. Trace how Max-Age 0 is serialized and how Expires is parsed, then verify that a cookie round trip preserves the deletion attributes and does not become a session cookie.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.