Java Cookie.setMaxAge（0）的行为是否归因于实现，还是有规范？

Question

I have a web application running on an old modified Tomcat installation. In order to delete a session cookie after logout, I have the following code:

Cookie sessionCookie = new Cookie("session",null);
sessionCookie.setMaxAge(0);
response.addCookie(sessionCookie);

In my web application, I have a problem in that it is returning the current time as the expires portion of the cookie:

Set-Cookie: sesssion=null; Expires=Sat, 18-Feb-2012 18:04:52 GMT

The problem is it only takes a client's PC to be a little behind the server for it to carry on sending the cookie!

However, in Tomcat 5.5, it returns:

Set-Cookie: session=null; Expires=Thu, 01-Jan-1970 00:00:10 GMT

Which is the more desired behaviour.

My question is are both correct, is there any official guide on how this should be implemented, the documentation just states:

A zero value causes the cookie to be deleted.

Perhaps I will have to add the Set-Cookie: header myself to get around this behaviour?

Answer 1

It seems there is nothing in the specification very specific about the implementation of that method.

However, you should never rely on cookies being immediately deleted by the browser, you shouldnt even rely to the browser deleting the cookie at all, since from the server you don't have control over the client behavior at all.

What are you storing in that cookie, could you simply use the session already managed by the container?

When you invalidate a Session on the server, even if the cookie stays on the browser it wont matter since it will be invalidated server side and the session ID in the cookie will not match an existing session anymore, and the objects that were bound to that session will be destroyed.

Answer 2

The browser will expire a cookie if the expire time <= current time.

If you're doing it manually, most people would return 0 epoch (which is what you're seeing with tomcat 5.5) or at the very least the current time minus some amount of time to account for clock drift. That being said, you can never account for an end user's computer's clock being completely hosed.

Even tomcat 5.5 is old software. It's EOL is September of this year (2012). It sounds like your problem is that you're running an ancient version of tomcat (or java) which hasn't been upgraded or maintained. Occasionally you do have to upgrade things.