Cookies have two attributes (Max-Age
and Expires
) that seem to serve identical purposes, namely specifying when a given cookie will expire.
According to MDN, Expires
:
Indicates the maximum lifetime of the cookie as an HTTP-date timestamp. See Date for the required formatting.
And Max-Age
:
Indicates the number of seconds until the cookie expires. A zero or negative number will expire the cookie immediately. If both Expires and Max-Age are set, Max-Age has precedence.
To me this sounds like they're completely synonymous, the only difference being the format in which the expiration date is expressed; with Expires
specifying an actual date-time, and Max-Age
specifying a time span.
It seems like Expires
actually predates Max-Age
, and Max-Age
was introduced much later, but why? That's my question. What shortcoming does Expires
have that Max-Age
looks to rectify? And when should one be preferred over the other? If the only thing that's different about Max-Age
is how it expresses the expiration date, then its introduction seems pretty pointless, doesn't it?
To my surprise, I couldn't actually find any relevant information on this, it seems as though I'm the only one for whom this is a question mark, which I find strange, so tell me if I'm missing something.
Note that my question isn't strictly about the technical difference between the two attributes (there are already questions like this one that cover this), I'm specifically curious about the reason and the motive behind the introduction of Max-Age
, when Expires
already existed and did fundamentally the same thing.
Because Max-Age
works correctly (approximately), even if the user (client) system clock was incorrect!
For example, if the server time was 13:00 PM (UTC) and the user's system time was (incorrectly) at 15:00 PM (UTC), then a cookie that is set on server side to expire on 14:00 PM (UTC) (using Expires=...
) will expire immediately on client side (because it's incorrectly at 15:00 (UTC))!
But by setting Max-Age=7200
(2 hours) it'll be live for 2 hours (approximately) (until 15:00 PM (UTC) according to server's clock, and until ~17:00 PM (UTC) according to the incorrect user system clock).
Note that this is NOT about different time-zones! It's about different times (when at least, one of them is incorrect).
Different time-zones don't necessarily mean different times! For example, 13:00 UTC
is the same as 14:00 UTC+01:00
(and their correctness is together: both correct xor both incorrect). But 13:00 UTC
is different from 13:00 UTC+01:00
(and if one of them is correct, the other one is necessarily incorrect)!
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With