Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why was `Max-Age` introduced for cookies when we already had `Expires`?

Cookies have two attributes (Max-Age and Expires) that seem to serve identical purposes, namely specifying when a given cookie will expire.

According to MDN, Expires:

Indicates the maximum lifetime of the cookie as an HTTP-date timestamp. See Date for the required formatting.

And Max-Age:

Indicates the number of seconds until the cookie expires. A zero or negative number will expire the cookie immediately. If both Expires and Max-Age are set, Max-Age has precedence.

To me this sounds like they're completely synonymous, the only difference being the format in which the expiration date is expressed; with Expires specifying an actual date-time, and Max-Age specifying a time span.

It seems like Expires actually predates Max-Age, and Max-Age was introduced much later, but why? That's my question. What shortcoming does Expires have that Max-Age looks to rectify? And when should one be preferred over the other? If the only thing that's different about Max-Age is how it expresses the expiration date, then its introduction seems pretty pointless, doesn't it?

To my surprise, I couldn't actually find any relevant information on this, it seems as though I'm the only one for whom this is a question mark, which I find strange, so tell me if I'm missing something.

Note that my question isn't strictly about the technical difference between the two attributes (there are already questions like this one that cover this), I'm specifically curious about the reason and the motive behind the introduction of Max-Age, when Expires already existed and did fundamentally the same thing.

like image 376
Arad Avatar asked Sep 13 '25 19:09

Arad


1 Answers

Because Max-Age works correctly (approximately), even if the user (client) system clock was incorrect!

For example, if the server time was 13:00 PM (UTC) and the user's system time was (incorrectly) at 15:00 PM (UTC), then a cookie that is set on server side to expire on 14:00 PM (UTC) (using Expires=...) will expire immediately on client side (because it's incorrectly at 15:00 (UTC))!

But by setting Max-Age=7200 (2 hours) it'll be live for 2 hours (approximately) (until 15:00 PM (UTC) according to server's clock, and until ~17:00 PM (UTC) according to the incorrect user system clock).


Note that this is NOT about different time-zones! It's about different times (when at least, one of them is incorrect).

Different time-zones don't necessarily mean different times! For example, 13:00 UTC is the same as 14:00 UTC+01:00 (and their correctness is together: both correct xor both incorrect). But 13:00 UTC is different from 13:00 UTC+01:00 (and if one of them is correct, the other one is necessarily incorrect)!

like image 188
Mir-Ismaili Avatar answered Sep 15 '25 10:09

Mir-Ismaili