setcookie() negative timestamp

[Erwane]

Description

The following code:

<?php
declare(strict_types=1);

date_default_timezone_set('UTC');

setcookie('old_timestamp', 'my value', 1);
setcookie('negative_timestamp', 'my value', -1);

Resulted in this output:

HTTP/1.1 200 OK
Host: localhost:8000
Date: Fri, 03 Mar 2023 17:33:45 GMT
Connection: close
X-Powered-By: PHP/7.4.33
Set-Cookie: old_timestamp=my%20value; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Set-Cookie: negative_timestamp=my%20value
Content-type: text/html; charset=UTF-8

But I expected this output instead:

HTTP/1.1 200 OK
Host: localhost:8000
Date: Fri, 03 Mar 2023 17:33:45 GMT
Connection: close
X-Powered-By: PHP/7.4.33
Set-Cookie: old_timestamp=my%20value; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Set-Cookie: negative_timestamp=my%20value; expires=Wed, 31-Dec-1969 23:59:59 GMT; Max-Age=0
Content-type: text/html; charset=UTF-8

(I'm really not sure about the expires=Wed, 31-Dec-1969 23:59:59 GMT.
Maybe if expires is negative, force to 1 ?

Same with php8.1

HTTP/1.1 200 OK
Host: localhost:8000
Date: Fri, 03 Mar 2023 17:47:04 GMT
Connection: close
X-Powered-By: PHP/8.1.16
Set-Cookie: old_timestamp=my%20value; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Set-Cookie: negative_timestamp=my%20value
Content-type: text/html; charset=UTF-8

Thanks.

PHP Version

^7.4 || ^8.1

Operating System

No response

[mvorisek]

I would expect a warning, negative integer (expire time before 1970) does not make sense. And threated as 0.

[thg2k]

Why did you change this? AFAIK there is nothing wrong with specifying a date before 1970 as expires header.

[iluuu1994]

@thg2k You already can't do so (a negative value is interpreted the same way as 0). It didn't seem useful to implement this now. Setting the expires header on negative values might also be harder to catch, as some people apparently use -1 as a value which will result in a cookie that expires immediately, vs an error.

Edit: I'm also ok with reverting the change if this is controversial. I doubt this is a common source of problems.

[thg2k]

I actually read the OP too quickly, I didn't realize that setting expire to -1 doesn't send expires=31-Dec-1969 23:59:59 GMT.

Nevertheless, this change is smelly. At the moment, setting the expires to -1 generates a cookie that expires at the end of the session (as per HTTP spec when you don't set any expires/max age value).

It is surely a BC break and should be mentioned in the upgrading file, but it would be a more subtle breakage to "fix" the behavior by generating the expires header with a negative value. I mean, if you upgrade and rely on the current behavior of negative values, it's better to get an error, easy to troubleshoot, rather than having your cookies expiring at the end of the session, expiring immediately.

[iluuu1994]

It is surely a BC break and should be mentioned in the upgrading file, but it would be a more subtle breakage to "fix" the behavior by generating the expires header with a negative value.

Yeah, that's my perception as well.

I'll revert the change for now. A discussion is warranted, but I don't feel like this is important enough to bother.

[iluuu1994]

Reverted the change here: 9f591c9
Re-opening this issue.

[Girgias]

This seems like a non-issue to me. The parameter takes a UNIX timestamp to define the date/time of expiration and not a duration. Is it pointless to set a timestamp that is negative? meh, it makes it clear that the cookie should not be set at the end of the session.