Cookies with expiry time set to epoch zero are matched and not expired

[faulpeltz]

If the server sends a cookie with expiry time set to epoch zero (1970-01-01T00:00:00.000Z), the cookie is then returned in getCookies(url) even though "expire" is set to true (the default)

This is because expiryTime here should be checked for undefined not just !expiryTime

tough-cookie/lib/cookie/cookieJar.ts

Line 940 in 1a71340

if (expireCheck && expiryTime && expiryTime <= now) {

[colincasey]

Thanks for the filing this issue @faulpeltz.

[domenic]

Hi! I'd like to gently request that a new version be released with this regression fix incorporated. It seems there have been a lot of meta-changes around dependencies, package publishing workflow, etc. since this was merged in September, but we still haven't seen an npm release with this fix.

For jsdom users, this is putting us between a rock and a hard place, where we can either use v4 which has deprecation warnings and working cookie deletion functionality, or v5 which has no deprecation warnings but broken cookie deletion abilities.

Of course, I understand very much that this is a spare-time project and you all are probably pretty busy. If you don't have time, I understand; I'm often that way with jsdom myself. But just in case it would make a difference, I wanted to drop a note letting you know how appreciated a new release would be.

Thanks!

[colincasey]

Hi @domenic, thanks for the gentle poke. Myself and the other maintainers invested most of our time after the previous release in setting up automation to make it easier for us to publish new versions more frequently and avoid this exact situation. Then we all got swamped with end of the year work and never got the chance to test this automation fully 😅

I'm going to be trying out our new publishing process this week. If that goes smoothly then such a large gap in releases shouldn't happen again.