Large cookie Max-Age overflows int in ServletServerHttpResponse, resulting in a session cookie or deletion #37472

Describe the bug

When the Max-Age of a ResponseCookie exceeds Integer.MAX_VALUE seconds, Servlet-based WebFlux servers emit a cookie that differs from the requested one. Depending on the value, it becomes a session cookie or the cookie is deleted. Reactor Netty and Jetty Core emit the requested Max-Age, so the behavior differs depending on the server.

To Reproduce

response.getCookies().add("remember", ResponseCookie.from("remember", "1")
                .maxAge(Duration.ofDays(36_500)).build());

Expected: the Max-Age remains positive, resulting in a long-lived cookie.

Suspected cause

ServletServerHttpResponse#applyCookies() performs the following conversion.

cookie.setMaxAge((int) httpCookie.getMaxAge().getSeconds());

The narrowing cast to int overflows, and Servlet Cookie#setMaxAge(int) interprets a negative value as a session cookie and 0 as deletion. RestTestClientResponseAssert performs the same conversion.

This can be fixed by limiting the converted value to Integer.MAX_VALUE, as in #37427.

Related Issues

• Avoid int overflow for large Duration timeouts in ClientHttpRequestFactory implementations #37427