Skip to content

Avoid int overflow for large cookie Max-Age values - #37473

Open
padosol wants to merge 1 commit into
spring-projects:mainfrom
padosol:fix/cookie-max-age-int-overflow
Open

padosol wants to merge 1 commit into
spring-projects:mainfrom
padosol:fix/cookie-max-age-int-overflow

Conversation

@padosol

@padosol padosol commented Oct 13, 2026 •

Copy link
Copy Markdown

Overview

ServletServerHttpResponse converts the Max-Age of a ResponseCookie via (int) getSeconds(), so values greater than Integer.MAX_VALUE seconds overflow, resulting in a session cookie or the cookie being deleted.

Changes

Testing

Added tests to ServletServerHttpResponseTests (new) and CookieIntegrationTests. Without the change, the 3 ServletServerHttpResponseTests cases and CookieIntegrationTests on Jetty and Tomcat fail.

./gradlew :spring-web:test --tests "*ServletServerHttpResponseTests" --tests "*CookieIntegrationTests" :spring-web:checkstyleMain :spring-web:checkstyleTest :spring-test:checkstyleMain

Signed-off-by: SangHoon Han <hzyan2@gmail.com>
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Oct 13, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged or decided on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants