- From: rifmj <notifications@github.com>
- Date: Mon, 02 Nov 2026 05:47:49 -0800
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Monday, 2 November 2026 13:47:53 UTC
rifmj left a comment (whatwg/fetch#1826)
One more remaining piece: removing expired cookies.
Fetch calls "garbage collect cookies" only while processing `Set-Cookie`, and nothing calls "remove expired cookies" otherwise. "Retrieve Cookies" has no expiry condition, because layered-cookies leaves this to Fetch and other callers (its "Requirements Specific to Browser User Agents" lists Remove Expired Cookies as a hook). So if no `Set-Cookie` is processed after a cookie expires, the steps return it:
`m=1; Max-Age=2`, then a request 4 seconds later with no response in between.
Chromium 156, Firefox 157 and WebKit 27.2 do not send it. This was already noted on #1807 ("clearing cookies periodically"), but it is not in the list above.
`cookies/attributes/expired-at-read.html` in web-platform-tests/wpt#64550 covers the request header and `document.cookie` separately, and passes in all three. I found no WPT that waits for expiry.
Drafted with AI help.
--
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1826#issuecomment-6578774659
You are receiving this because you are subscribed to this thread.
Message ID: <whatwg/fetch/issues/1826/6578774659@github.com>
Received on Monday, 2 November 2026 13:47:53 UTC