18

I'm on NodeJS, Express app i am using cookies for some features of my app. I need to set cookie life to one month.

For this very purpose i've set cookie maxAge to days*hoursPerDay*minutesPerHour*secondsPerMinute*1000 to achieve one month time 30*24*60*60*1000 = 2592000000.

Yet in browser expiry of my cookies is near 10 hours.

What am i missing, my calculations are wrong? or I am using wrong attribute(maxAge)?

Also what is the difference between maxAge and expiry attribute of cookies?

2
  • Not a Express user but... Raw cookies require setting a concrete date so maxAge is probably a convenience wrapper. Commented Apr 21, 2014 at 12:30
  • Expires has been available for longer than Max-Age, however Max-Age is less error-prone, and takes precedence when both are set. The rationale behind this is that when you set an Expires date and time, they're relative to the client the cookie is being set on. If the server is set to a different time, this could cause errors. developer.mozilla.org/en-US/docs/Web/HTTP/… Commented Aug 13 at 9:06

2 Answers 2

6

As far as i know, maxAge wont save in cookie's specifications.
As Don't trust Cookie setMaxAge demonstrated, The mechanism of maxAge works like Change/manipulate expiration date of cookie (based on SERVER_SIDE) but browser checks cookie's expiration date, based on CLIENT_SIDE.
From my point of view, This is misbehavior. Because in order to make max-age work as expected, both client/server DateTime should be synchronized.

1
  • 3
    I mean, yes Internet Explorer (IE6, IE7, and IE8) does not support “max-age”, but who cares. It’s no longer 2009 (the date of the cited blog post).
    – Alex Klaus
    Commented Mar 20, 2021 at 0:40
1

maxAge should be set in milliseconds ( i was wrong, as i referred to client part) https://developer.mozilla.org/en-US/docs/Web/API/document.cookie

are you setting coolie like below?

res.cookie('rememberme', '1', { maxAge: 900000, httpOnly: true }) http://expressjs.com/api.html#res.cookie

4
  • but when i used 900000 it gave me 15mintues? Commented Apr 21, 2014 at 12:24
  • how are you testing and confirming its only 1 hour, i mean do you change the browser/client time values?
    – subbul
    Commented Apr 21, 2014 at 13:47
  • i am using chrome's developer tools for debugging almost all frontend aspects of my app... Commented Apr 21, 2014 at 15:00
  • 900, 000 milliseconds should be 15 minutes. Commented Oct 30, 2015 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.