Reparsing cookie loses Max-Age/Expire attributes
- Dominant language
- Java
- Stars
- 4.1k
- Forks
- 2k
- Avg merge
- 3d 56m
- Merged PRs (30d)
- 48
Description
**Jetty version(s)**
12.1.13
**Jetty Environment**
e11
**HTTP version**
1
**Java version/vendor** `(use: java -version)`
openjdk version "25.0.1" 2025-10-21 LTS
OpenJDK Runtime Environment Temurin-25.0.1+8 (build 25.0.1+8-LTS)
OpenJDK 64-Bit Server VM Temurin-25.0.1+8 (build 25.0.1+8-LTS, mixed mode, sharing)
**OS type/version**
Ubuntu 24
**Description**
This comes from my initial report in spring-boot where the cause was reduced to jetty specifics rather than spring-boot (https://github.com/spring-projects/spring-boot/issues/51770#issuecomment-5682450799) , thus I'm filing the report here as well:
When a cookie created with Max-Age 0 is turned into a String it only get's an Expires attribute, and when it's parsed back into a cookie it looses the Max-Age as well as the Expires attributes.
**How to reproduce?**
```java
HttpCookie builtCookie = HttpCookie.build("biscuit", "").maxAge(0).build();
String builtCookieHeader = HttpCookieUtils.getRFC6265SetCookie(builtCookie);
System.out.println(builtCookieHeader);
HttpCookie parsedCookie = SetCookieParser.newInstance().parse(builtCookieHeader);
System.out.println(HttpCookieUtils.getRFC6265SetCookie(parsedCookie));
```
The above produces the following output:
```
biscuit=; Expires=Thu, 01 Jan 1970 00:00:00 GMT
biscuit=
```
The expected outcome would be to also include the Max-Age when creating the raw cookie string, as well as to maintain the MaxAge in the parsed cookie. The above turns the cookie into a session cookie rather than removing it.
This might be related to https://github.com/jetty/jetty.project/issues/15760
Contributor guide
Research direction
Start with HttpCookie.build, HttpCookieUtils.getRFC6265SetCookie, and SetCookieParser.newInstance().parse using the reproduction in the issue. Trace how Max-Age 0 is serialized and how Expires is parsed, then verify that a cookie round trip preserves the deletion attributes and does not become a session cookie.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100