No 'Max-Age'

[plenluno]

If a cookie has no 'Max-Age', it generally expires when the web browser closes.
Golang's Cookie supports this feature.
See https://golang.org/pkg/net/http/#Cookie

Currently gorilla/csrf don't seem to support the feature and set Max-Age to 12 hours instead.
I think gorilla/csrf should not set Max-Age if the user explicitly set the MaxAge option to 0
and should set Max-Age to 12 hours for compatibility if the user don't pass the MaxAge option.

What do you think?

[elithrar]

What is the use-case supported by MaxAge=0?
On Fri, Jun 10, 2016 at 10:24 PM Yoshiyuki Mineo notifications@github.com
wrote:

If a cookie has no 'Max-Age', it generally expires when the web browser
closes.
Golang's Cookie supports this feature.
See https://golang.org/pkg/net/http/#Cookie

Currently gorilla/csrf don't seem to support the feature and set Max-Age
to 12 hours instead.
I think gorilla/csrf should not set Max-Age if the user explicitly set the
MaxAge option to 0
and should set Max-Age to 12 hours for compatibility if the user don't
pass the MaxAge option.

What do you think?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#38, or mute the thread
https://github.com/notifications/unsubscribe/AABIcE4j-ZD6JN0c0pDFSMBIbeEh5NcYks5qKkaNgaJpZM4Izebr
.

[plenluno]

Session cookies with no 'Max-Age' and 'Expires' are often used to store the state of an anonymous user.
CSRF tokens also have the same life cycles in that case.

The default behavior of a cookie is defined officially in
https://tools.ietf.org/html/rfc6265
and supported by most frameworks and libraries such as Rails, Express.js and gorilla/sessions.

[elithrar]

Thanks. I'm aware of the RFC: I wanted to understand how your application worked in this regard. Since gorilla/csrf does not set the MaxAge field (for wider browser compatibility) the fix is pretty simple:

    // Set the Expires field on the cookie based on the MaxAge
    if cs.maxAge > 0 {
        cookie.Expires = time.Now().Add(
            time.Duration(cs.maxAge) * time.Second)
-   } else {
+   } else if cs.maxAge < 0 {
        cookie.Expires = time.Unix(1, 0)
    }

(I'll push a change tomorrow unless you want to submit a PR and a test case)

[plenluno]

(I'll push a change tomorrow unless you want to submit a PR and a test case)

Thank you. I'll leave it to you.

[elithrar]

Fixed in #39 @plenluno - let me know if any issues.

[plenluno]

LGTM. Thanks a lot.