remove cookie method still contains cookie value

406 views
Skip to first unread message

Steve Hummingbird

unread,
Aug 26, 2020, 10:35:37 AM8/26/20
to vert.x
When I call `routingContext.removeCookie('MyCookie');` in order to remove a cookie, vertx response with and header like 

set-cookie: MyCookie=MyValue; Max-Age=0; Expires=Wed, 26 Aug 2020 14:17:01 GMT

While theoretically Max-Age=0 should lead to the cookie being removed from browsers, this sometimes is not the case. 

To work around this, I do not call routingContext.removeCookie('MyCookie'); but I call addCookie with the same name, and an empty string as value together with a short expiry. This seems to work more reliably.

Long story short: Why does removeCookie still submit the cookie value?

This stack overflow post deals with the same issue, suggesting that an invalid value should be set in addition to expiring it.

Paulo Lopes

unread,
Sep 11, 2020, 2:07:56 PM9/11/20
to vert.x

max-age 0 or negative expires the cookie immediately, if both max-age and expires are present, max-age takes precedence, so adding a short expires should have no real world effect.

Indeed we could also clear the value, but for the rest, we are following the specs. What user agent are you using that doesn't work as expected with this behavior?
Reply all
Reply to author
Forward
0 new messages