1992998 - Randomly throwing `Cookie “foo” has been rejected because its expiration date is over the limit` when setting expiration date to Fri, 31-Dec-9999 23:59:59 GMT

Status: RESOLVED DUPLICATE of bug 1992536

(Core :: Networking: Cookies, defect)

Description

[Denis]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0

Steps to reproduce:

Our application sets the cookie expiration date to Fri, 31-Dec-9999 23:59:59.

Here is a minimal reproducible example in Python::

from flask import Flask, request, make_response

app = Flask(__name__)
counter = 0

@app.route("/")
def index():
    global counter
    counter += 1

    resp = make_response(f"Cookie: {request.cookies.get('foo')}")
    resp.set_cookie("foo", str(counter), expires="Fri, 31-Dec-9999 23:59:59 GMT")
    return resp

app.run()

Actual results:

We noticed that sometimes the value is ignored and the message appears in the console:

Cookie “foo” has been rejected because its expiration date is over the limit.

This happens inconsistently.

Expected results:

The value is consistently updated without errors. Same behavior in Chromium.

OR

The error always occurs when setting the expiration date to Fri, 31-Dec-9999 23:59:59.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: Cookies' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Denis]

I tried to gather some more information:

• This is happening in a new profile with the latest stable (v143) and the latest beta (v144)
• When cookie is successfully set, the expiration date is today+400 days
• This does not seem to happen in the latest ESR (v140)
• This does not seem to happen in the latest nightly (v145)
• I don't know how to reliably reproduce the bug, e.g. it occurs on one machine and does not occur on another. But it is confirmed that it occurs on different machines.

Comment 3

[Sunil Mayya]

Looks like the source of error on console and check for maximum expiration date is set from here.
We do not enforce checks if the session attribute is true.
But it is skipped if the session attribute is true. I am guessing the inconsistency is because of this flag being true or not?
Ed any thoughts?

Comment 4

[Andrea Marchesini [:baku]]

This bug is already fixed by bug 1992536, landed in nightly recently. This is why in nightly it cannot be reproduced. And it cannot be reproduced in ESR 140 because the CookieValidation object landed after 140.