[HTTPCLIENT-1763] Invalid 'expires' attribute

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 4.5.2
• Assignee: Unassigned
• Reporter: Oliver Stöneberg
• Created: 23/Aug/16 11:57
• Updated: 07/Mar/19 09:15
• Resolved: 23/Aug/16 13:04

Description

We updated HttpClient from 4.3.6 to 4.5.2 and suddenly these warnings started appearing:

[org.apache.http.client.protocol.ResponseProcessCookies] Invalid cookie header: "Set-Cookie: PLAY_SESSION=; Max-Age=0; Expires=Tue, 23 Aug 2016 11:40:12 GMT; Path=/; Secure; HTTPOnly". Invalid 'expires' attribute: Tue, 23 Aug 2016 11:40:12 GMT

Looks like this is actually a valid date according to several references:
https://en.wikipedia.org/wiki/HTTP_cookie#Expires_and_Max-Age
https://issues.apache.org/jira/browse/HTTPCLIENT-773
https://issues.apache.org/jira/browse/HTTPCLIENT-1077
https://issues.apache.org/jira/browse/HTTPCLIENT-923

We are not using any specific sookie spec, so CookieSpecs.DEFAULT is being used.

Looking at the source DefaultCookieSpec is being used which detects the netscape format by looking at "expires" in the "Set-Cookie" handler which leads to NetscapeDraftSpec feeding BasicExpiresHandler the NetscapeDraftSpec.EXPIRES_PATTERN which looks wrong to me.